Should Angular client store user roles in local storage?

user_3113511 0
Viewed 1380

In my Angular app, based on the logged in user, I would like to grant or limit functionality by showing/hiding different menu items or allowing/disallowing certain routes. Currently on successful login, my .NET Core API returns a JWT Token along with the user's Role and stores it in local storage. I then use this to display my menu (for example). I'm just having doubts that this is the best practice as it exposes my user's role and I'm not sure what might happen if someone manually changes this in local storage.

enter image description here

Is there a better/more secure way of achieving this?

Please let me know if you need more details. Thanks

angular local-storage .net-core roles
1 Answers

You can't change your JWT token manually, because it was generated used private key (or secret key). Without private key you can't create new token with updated roles. So user is not able to do this. Of course he can decode token, but he can't encode valid new one

user_26973000
Related