Angular Get Spring Roles from JWT

Question

I have two roles in my REST back-end (built with Spring):

ROLE_USER, ROLE_ADMIN

When I log in, the REST API returns a valid token. Then I set it in the local storage like this:

localStorage.setItem('currentUser', JSON.stringify({username: username, token: token}));

And when I need it I get it like this:

localStorage.getItem('currentUser');

So far so good. When I get my token how do I get the payload and the claims in it?

I want to show admin panel if you are an admin.

score 2 · Accepted Answer · answered May 18 '17 at 11:31

2

jwtHelper.decodeToken($scope.jwt)

See https://github.com/auth0/angular-jwt and https://github.com/auth0/angular2-jwt

an example https://github.com/auth0-blog/angularjs-jwt-authentication-tutorial/blob/8841ad5d7cb034506d2e3e6840db6202e6969b7a/frontend/home/home.js#L16

answered May 18 '17 at 11:31

StanislavL

56,971
9
68
98

10x, I have two concerns about the library: 1) this.jwtHelper.decodeToken(token) how is this going to decode my token if I dont provide the secret? 2) If I provide the secret somehow isn't that a vulnerability? – Teodor Dimitrov May 18 '17 at 12:58
http://stackoverflow.com/questions/31953325/how-is-angular-jwt-decoding-my-jwt-without-a-secret check this – StanislavL May 18 '17 at 13:01
Thanks, this is what I needed! :) – Teodor Dimitrov May 18 '17 at 13:07

score 0 · Answer 2 · answered May 18 '17 at 11:39

0

It is very difficult to identify user role based on the token, Better add a new flag like IS_ROLE_USER, IS_ROLE_ADMIN and based on that flag check the current user role. Or else use spring boot security. Might it will help you.

answered May 18 '17 at 11:39

Avinash Kumar

1

I am using Spring Security. However, I don't know how to hide a div containing the Admin options. – Teodor Dimitrov May 18 '17 at 12:43

score 0 · Answer 3 · answered Aug 29 '17 at 19:44

0

The other answers covered the spring part of your question, so I'm going to focus my answer on the angular part.

You can use a directive to show/hide the admin panel like so:

<admin-component *ngIf="user.isAdmin"></admin-component>

answered Aug 29 '17 at 19:44

Kloranthy

1
1

Angular Get Spring Roles from JWT

3 Answers3