React Typescript Context Auth JWT - 37. Protected Routes

React Typescript Context Auth JWT - 5. Protected Routes

[anthonyoconnell]

Hi Teddy, just finished your mvc videos. Great series. Thanks a lot dude!
I am having trouble downloading the project from github.
I unzipped the file, connected it to my own cloudinary account and sql server.
However I am getting an error when I update the database/ add a migration and try to seed the data.
Would you mind uploading a video or recommending a video that goes through the necessary steps to run the project. Thank you.

[iamabhirupdatta]

Hey, thanks for this video. 1 suggestion: we can use PropsWithChildren from react, instead of manually typing children:ReactNode.

[Prag]

Something's been on my mind. ProtectedRoute points to the {children} property depending on the boolean value returned by the isLoggedIn function and the isLoggedIn function returns true or false depending on whether the user object (this is a state) exists or not. And we set the user object when the page is rendered in the useEffect hook using the user and token information we get from localStorage. This means that the value returned by the isLoggedIn function is completely dependent on the existence of user and token information in localStorage (This information does not need to be valid, it just needs to exist).

So malicious people who normally cannot see these pages can see them just by adding the "user" and "token" information to localStorage. (As I said, this information does not need to be valid. They just need to exist).

Isn't this a security flaw? To solve this problem, shouldn't we check if the logged in user token exists in the database? How can we fix this flaw?

Pardon me for my English.