{"action":"created","issue":{"url":"https://api.github.com/repos/auth0-blog/angular2-authentication-sample/issues/71","repository_url":"https://api.github.com/repos/auth0-blog/angular2-authentication-sample","labels_url":"https://api.github.com/repos/auth0-blog/angular2-authentication-sample/issues/71/labels{/name}","comments_url":"https://api.github.com/repos/auth0-blog/angular2-authentication-sample/issues/71/comments","events_url":"https://api.github.com/repos/auth0-blog/angular2-authentication-sample/issues/71/events","html_url":"https://github.com/auth0-blog/angular2-authentication-sample/issues/71","id":161234962,"number":71,"title":"LoggedInOutlet is insecure","user":{"login":"smith64fx","id":3246782,"avatar_url":"https://avatars.githubusercontent.com/u/3246782?v=3","gravatar_id":"","url":"https://api.github.com/users/smith64fx","html_url":"https://github.com/smith64fx","followers_url":"https://api.github.com/users/smith64fx/followers","following_url":"https://api.github.com/users/smith64fx/following{/other_user}","gists_url":"https://api.github.com/users/smith64fx/gists{/gist_id}","starred_url":"https://api.github.com/users/smith64fx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smith64fx/subscriptions","organizations_url":"https://api.github.com/users/smith64fx/orgs","repos_url":"https://api.github.com/users/smith64fx/repos","events_url":"https://api.github.com/users/smith64fx/events{/privacy}","received_events_url":"https://api.github.com/users/smith64fx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-20T16:16:51Z","updated_at":"2016-06-20T20:10:11Z","closed_at":null,"body":"On line 27 of the LoggedInOutlet you say:\r\n```\r\nif (!this.publicRoutes[url] && !localStorage.getItem('jwt')) {\r\n```\r\n\r\nSo if I set my localStorage item 'jwt' to any value, I am authenticated. You are not checking, if the jwt token is valid.\r\n\r\nPretty simple to hack :)\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/auth0-blog/angular2-authentication-sample/issues/comments/227254685","html_url":"https://github.com/auth0-blog/angular2-authentication-sample/issues/71#issuecomment-227254685","issue_url":"https://api.github.com/repos/auth0-blog/angular2-authentication-sample/issues/71","id":227254685,"user":{"login":"chenkie","id":1847678,"avatar_url":"https://avatars.githubusercontent.com/u/1847678?v=3","gravatar_id":"","url":"https://api.github.com/users/chenkie","html_url":"https://github.com/chenkie","followers_url":"https://api.github.com/users/chenkie/followers","following_url":"https://api.github.com/users/chenkie/following{/other_user}","gists_url":"https://api.github.com/users/chenkie/gists{/gist_id}","starred_url":"https://api.github.com/users/chenkie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chenkie/subscriptions","organizations_url":"https://api.github.com/users/chenkie/orgs","repos_url":"https://api.github.com/users/chenkie/repos","events_url":"https://api.github.com/users/chenkie/events{/privacy}","received_events_url":"https://api.github.com/users/chenkie/received_events","type":"User","site_admin":false},"created_at":"2016-06-20T20:10:11Z","updated_at":"2016-06-20T20:10:11Z","body":"Very true :) However, no amount of protection on the front end is going to fully secure a browser-based application. Anyone with enough knowledge and motivation would be able to force protected routes to become available if they wanted to.\r\n\r\nLuckily, that's not the point. The stuff that is actually sensitive is the data that is retrieved from the backend and displayed on the front end. Since we're protecting the app with JWT, the user wouldn't be able to get at any of the data on the backend if they didn't have a valid JWT anyway. So while they might be able to get to a front end route that we'd like to keep them away from, it won't be of any use to them once they get there because they won't be able to get any data for it."}}
{"actor":{"display_login":"chenkie"}}