I've created a SPA using react.js, I have a .net core 3.1 API/Backend and I'm using microsoft identity to issue JWT's when a user logs in, I haven't implemented identity server or any other 3rd part code and I'm currently storing the logged in users token in local storage. My question is two part -
I've read a lot about security and auth and realise local storage may not be the best option however there isn't really an alternative given in most cases, so what is the best option?
The second part of my question is regarding Roles and claims, Is it Ok to return in the user object (along side the token) a list of roles and a list of claims? I realise that someone that knows what there doing could start changing things to allow them to see pages, buttons and "things" that they shouldn't however everything is validated server side and I cant really see an alternative to this "smoke and mirrors approach". For example if I have a page that conditionally displays a delete button a user without the required role may be able to delve into react dev tools and mess around to make that button appear however the server would reject the request if the user didn't actually have the relevant role/claim.
Any advice/link/point in the right direction would be appreciated