0

I'm currently creating a custom CMS for a friend's soccer team. The architecture is as follows:

On the back-end I've an API that interacts with the database (mongoDB).

On the front-end I've an express server that serves the pages using the templating engine handlebars.

Currently I've managed to authenticate requests to the API using Passport and JWTs, which is fine for querying the API, on login I'm storing a JWT with permissions in the cookie storage within the user (it's static pages and not a SPA so I cannot access local/session storage).

My issue is that I am struggling how to implement authorization on the client end for access to the admin panel. Should I decode the JWT on the client-end and read the user role then serve the pages if the admin pages if the user is an admin or should I be sending every request to access the admin section of the front-end to the API for a verification check then serve the files.

Any help would be greatly appreciated, thank you.

makory
  • 77
  • 9

1 Answers1

0

I think using a token authentication approach is more suited towards making requests via XHR, rather than hard reloads. The approach you are taking seems to be more suited to a session based authentication strategy. I would use passport-local and authenticate with a user name and password. Once authenticated the user is stored server side in a session variable. You could check the role from that and redirect server side.

If you were to stick with a token you could save it in local storage and then have a script on your admin panel that would first grab the token from local storage and then make a GET request to the server with the token in the header. If the token is valid send back the data to populate the page, otherwise send back an error and redirect from the front end. To get around showing an empty admin panel while checking the validity of the token you could show a loading screen until the request completed.

pizzarob
  • 11,711
  • 6
  • 48
  • 69
  • Thanks for the reply. If I were to use a local strategy for authentication would this also be suited for protected API routes that I'd be querying and posting to from the client front end? – makory May 10 '17 at 20:31
  • @makory yes you could create a middleware for protected routes, or check within the route function itself for the user object on the session. You could verify that the user had the proper roles and return the appropriate response. – pizzarob May 10 '17 at 20:35