Hey there! Sorry for the late reply, but you’re absolutely right about data on the client-side. This tutorial is actually a 2 part series! This first part was meant to be focused on the login portion and then part 2 shows how to set up the Express backend, where the protected data is stored.
With part 2, the user must sign in and pass a valid access token to the backend before the backend will even respond with the data. The beforeAuth guard in this tutorial was meant to redirect the user to the login page for UI purposes, but I see how that was confusing. I’ve updated the tutorial to make it clear that part 2 is where the authorization happens and that any data you store in the client-side is should always be considered available to the public, so thank you for pointing that out!