Make sure that users cannot exploit JWT to gain admin access

Rembane / lemmingpants

A system to handle the speakerlist on Datateknologsektionens meetings.

Apache License 2.0

6 stars 5 forks source link

Make sure that users cannot exploit JWT to gain admin access #91

Open Rembane opened 5 years ago

Rembane commented 5 years ago

We check that a user has the right role for them to gain access to the admin interface, and a user can easily change this and I'm cool with that, but the user shouldn't be able to send any commands to the server.

The code: https://github.com/Rembane/lemmingpants/blob/master/frontend/src/Components/Admin.purs#L73