Ant-design-pro: Authorization Can be bypassed via localStorage.setItem()

[Popesites]

Hello,

It seems that authorization can be bypassed altogether when users open their browser console and type the following (dependent upon the authorization defined in routes:

localStorage.setItem('antd-pro-authority', "[\"admin\"]");

You can test this for yourself by following these steps:

1. Navigate to https://preview.pro.ant.design on a private browser
2. log out of the admin
3. Run localStorage.setItem('antd-pro-authority', "[\"admin\"]"); in your browser console
4. Navigate to https://preview.pro.ant.design and see the dashboard

Is this a known bug? Is this authorization strategy just here temporarily for mock/demo purposes and meant to be refactored by developer?

[chapskev]

Yes, this is for demo purpose.

You can check how auth2 and JWT token plays together.

You can close the issue if this answers your question

[Popesites]

Ok thanks, I was able to implement JWT strategy to secure the application.