Best Practices for Retrieving User Permissions in a SPA (Vue.js) with Node.js API using Auth0

[tyf]

Hey there @viniciusteixeiradias !

Thanks for the detailed description, very helpful

@viniciusteixeiradias

Given these options and challenges, I am seeking guidance on which approach is more recommended or if there is a standard practice for handling the retrieval of user permissions in a SPA with an API using Auth0. Any suggestions or similar experiences that can guide my decision would be greatly appreciated.

I think your best bet is to add the permissions to ID tokens by way of the Management API/Node Management Client by way of an action as outlined here:

How to add Roles and Permissions to the ID Token using Actions?

Problem statement Is it possible to retrieve the user’s Roles and/or Permissions and include them in the JWT Token? Solution Yes, it’s possible to retrieve the user’s Roles and/or Permissions and append them to either the ID Token or Access Token. To do so, you must use a Post-Login Action script. 1.1 Roles When adding the user’s Roles to the token, call the event.authorization.roles property and add it as a custom claim to the Token. Please see here on creating namespaced custom claims. Be…