ankushjain2001 / fastapi-react-mongodb Goto Github PK

Hi, I'm new to auth in js so I may be mistaken here, but isn't it dangerous to authenticate by checking a plain string permissions in localStorage as is done below in auth.js? Can't the user tamper with LocalStorage and send a request that gives them user permissions even if they shouldn't have them? With a JWT, because we sign it with our secret on the server side, when a user sends a token we can verify that it is valid and that we signed it, but I think by just sending a plain string you risk the user spoofing the permission and claiming to be a user.

Either way thank you for sharing your code, I'm using it to figure out how to integrate fastapi users in React and your code is very helpful. Cheers!

isAuthenticated = () => {
    const permissions = localStorage.getItem('permissions');
    if (!permissions) {
      return false;
    }
    return permissions === 'user' ? true : false;
  };