'where to store currentUser
I have a simple login system and when a user logs in in I store the users data in sessionStorage as "currentUser". But I discovered that it can be edited. I use google firebase by the way.
Solution 1:[1]
What you would need to do is prevent easy manipulation. JWTs(as a pretty widely used standard) for example solve this by storing a signature on top of the actually relevant data.
If the signature doesn't match a newly generated signature for secret+data anymore, it'll be invalid. Make sure to not share the secret itself with the frontend, because pretty much everything can be read out.
More on JWTs: https://jwt.io/
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Björn Büttner |