Guards cannot guarantee the confidentiality of parts of the application about jump-the-queue HOT 1 OPEN

Hi @Jan-PeterRichterCG,

I disagree about your Guards statement. What Guards guarantee is that a specific route in your frontend app is accessible or not depending on some criteria that the developer will specify implementing the proper methods as stated in the Angular documentation https://angular.io/guide/router#milestone-5-route-guards. Removing the Guards in the running code is really challenging and I encourage you to take a look to the generated code in the Chrome Dev Tools in any Angular application in production in order to find out if it is possible to do it. Angular is developed by Google and I can imagine that the security is a critical topic to them.

In this case, a simple tutorial, the developers will develop a canActivate method to find out if the user can or cannot access a particular route.

The mechanism is proved and used in multiple projects, but of course has to be properly aligned and validated with the security mechanisms at backend. For example canActivate could check if the user has a correct JWT or CSRF tokens in browser memory or cache that will be sent automatically in HTTP requests via interceptors. If the user sents a request with an expired or not valid token for example the server will respond with an error and the next canActivate execution will redirect the user to the login form.

Best regards,
Santos

from jump-the-queue.