Angular-oauth2-oidc: Easy tampering with 'id_token_claims_obj' json data

[joeystdio]

When you for example have a role claim that your angular application relies on to show/hide stuff it is currently possible to just tamper with the id_token_claims_obj in localstorage (or whatever storage your using) by adjusting the json string.

It might be a good idea to let getIdentityClaims() method always parse the IdToken for its data.

What do you think?

[manfredsteyer]

In an browser-based SPA showing/hiding stuff can IMHO never be about security. It's about usability b/c everyone can temper with everything, even the source code. The real security should take happen on the server side.

[joeystdio]

I agree on securing serverside as well but that’s not a reason to make it easier for a user to tamper with data in the browser by storing a token as readable json. It’s not for nothing that an issuer sends back a token and not a human readable json object.