AngularJS JWT local authentication doubts

Issue

I'm currently developing a MEAN based application, I was thinking about the Angular JWT local authentication. The backend API verifies the token server-side, so is no problem, but in the client-side authentication is handled locally. What happens if someone tries to modify the authentication scripts locally?Will he bypass the authentication?In the case how can I avoid the problem?

Solution

Your client side app only contains views, empty html, but no data. It's usually ok to let anybody see that, view structure need not be a secret in most cases.

You are saying the server does authenticate the user though, which is fine, only authorized data should be returned and filled in the view templates.

To put it in other words, there is no such thing as client side authentication in this sense. That's more like a ux feature to not show funcionality that the user cannot access anyway.

Answered By - Gabor Lengyel