My Angular2 app uses OAuth2 with password grant type for authentication. I currently store the session token on sessionStorage, but I need to securely store additional data such as user roles.
While I am aware that sessionStorage or localStorage can be easily modified by users, my backend is secure as it checks the token against user roles. However, I want to prevent users from viewing hidden options if they modify their roles.
I am considering two solutions and would appreciate any tips:
- Encrypting the role before storing it in sessionStorage - what encryption method should I use?
- Implementing a global service as outlined in the angular documentation, which will be utilized by my navbar-component to load data during ngOnInit (due to routes).
Any suggestions? Thank you.