3

I'm developing a simple personal blog engine in MEAN stack using JWT as authentication method. I would like to implement a front-end admin panel page accessible only to Admin users. I have already implemented a simple role system where i can retrive the user's role both server side (in the db) and client side (saving the "role" property of the user in the jwt token).

Question is: how to implement a secure access to the admin page and maintain the single page application structure?

I could simply implement that with angular ui-route, checking the role in jwt token, but an user could simply exploit that with local modification in the js scripts, accessing the admin page without authorization.
Or i could implement that server side, serving the admin page only if the user has the right authorization; this is definitely safer, but so i will lose the single page structure because I have to send a different page.

Thanks in advance for any help/advice/answer you will give

1
  • 1
    have you solved the issue? As I see this question was asked 1 year ago and there is still not a single answer.. I am struggling with the same question. Local JS modification/injection should allow unauthenticated person to see literary ANY page, be it admin page or any other page (without back-end data, of course.. but still..)
    – Alex
    Feb 18, 2017 at 15:44

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.