# Force Relational Query / Disallow user to see other users data

**URL:** <https://community.dreamfactory.com/t/force-relational-query-disallow-user-to-see-other-users-data/419>\
**Category:** REST API\
**Created:** [October 3, 2014, 11:22am UTC](https://community.dreamfactory.com/t/force-relational-query-disallow-user-to-see-other-users-data/419 "2014-10-03T11:22:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![krzysztofweglinski](https://avatars.discourse-cdn.com/v4/letter/k/7993a0/32.png) [@krzysztofweglinski](https://community.dreamfactory.com/u/krzysztofweglinski)\
**Post date:** [October 3, 2014, 11:22am UTC](https://community.dreamfactory.com/t/force-relational-query-disallow-user-to-see-other-users-data/419/1 "2014-10-03T11:22:08Z")

</div>

Hey, small question from frontendDev, I know how to ask server about relational queries, but assuming I’m useing angular - user can modify query to see another’s user “todolist”(for example) which I’d like to prevent to. How? 🙂

**Example:**  
User with id:1, have contacts with phone numbers  
User with id:2 queries database through api, database returns only contacts with user\_id:2 even if he tries to manipulate query, only session allowed to pass id.

If I made something unclear here - ask me please 😄

---

<div class="post-metadata">

**Author:** ![krzysztofweglinski](https://avatars.discourse-cdn.com/v4/letter/k/7993a0/32.png) [@krzysztofweglinski](https://community.dreamfactory.com/u/krzysztofweglinski)\
**Post date:** [October 3, 2014, 1:41pm UTC](https://community.dreamfactory.com/t/force-relational-query-disallow-user-to-see-other-users-data/419/2 "2014-10-03T13:41:29Z")

</div>

ok, I’ve found another topic with explanation

> [@How would I manage (in the DSP), every user has his/her own Todo-List?](https://community.dreamfactory.com/t/how-would-i-manage-in-the-dsp-every-user-has-his-her-own-todo-list/181/3):
>
> Hi Ben, thanks for the info. A sample todo-app would be definitely quite informative here… andy