Auth require valid token by default

[Tibing]

Each auth module(login, redirect, etc.) has requireValidToken setting which is false by default. If that setting set to true module will fail in cases of positive response (Http status 200) with an invalid token. Otherwise, it will signal that operation completed successfully, however it was actually failed.

I propose to set requireValidToken to true by default. Because it sounds more like natural behavior for modules.

[electronomad]

I'm using NbAuthJWTToken as wrapper class to authenticate users to /pages/** and i noticed that if i change the value of the json web token from local storage the user still authenticated even with invalid token !! below my module configuration :

NbAuthModule.forRoot({
strategies : [
NbPasswordAuthStrategy.setup({
name : 'email' ,
baseEndpoint : 'http://localhost:8088/api' ,
login : {
endpoint : '/authenticate' ,
method : 'post',
requireValidToken : true ,
redirect : {
success : '/pages' ,
requireValidToken : true ,
failure : null ,
error : true ,
}
} ,
token : {
class : NbAuthJWTToken ,
key : 'id_token' ,
}
}) ,
],
@nnixaa
So how can I verify the token validity after every route call ?
Regards

[nnixaa]

@digitalberry-ahmed could you post an example of how you make this change to the token?

[electronomad]

Thank you for your responsiveness @nnixaa
After the authentication , if I delete the last 4 characters of the token value no validation on token validity is made and the /pages/* remains accessible

[nnixaa]

Well this is expected behavior since Nebular cannot be aware of the external changes you made outside of the Angular.
In this very case, you need to refresh the page to notify Nebular about the changes made.
On the other hand, if you want to manually control a token from your code - you can inject NbTokenStorage and call clear method. More details on the API https://akveo.github.io/nebular/docs/auth/nbtokenlocalstorage#nbtokenlocalstorage