SPA + Permissions

[donr]

followed this scenario here:

API and SPA Configuration (SPAs + API)

I do not understand if I am misusing or there is a genuine problem here…

I have an SPA + API application, I am using Authorization Core, I have added permissions to the API ( I cannot add permissions to an SPA from the UI ) , I have created a Role that utilizes some of these permissions, I applied the Role to a User, however there isn’t seem to be a way to get the permissions into the token when I login using the SPA.

My SPA does not have routes or content that is visible based on permissions, the only thing that the permissions are applying to are what routes / apis the users can access with what HTTP methods.

So either 1. I do not even need the SPA Application and just use M2m or 2.this is a problem and I will use a Rule that will get the user permissions and add them to the token during login from the SPA

Please help!

[jacob3]

Did you ever figure anything out?

I find myself in the same boat.

[jacob3]

This is what I found when working with SPA and API’s:

SPA using an API through a WebSocket

I’ve been circeling around this problem for a while now, and I find myselft pretty close to a solid solution. I want to share what I found before asking my questions. Both to give some context and to share some information that I found poorly communicated in the Auth0 Docs where WebSockets seems to be a banned word. In retrospect it is clear that a WebSocket can and should be treated the exact same way as a good old HTTP REST API, but when you are in the thick of it WebSockets seems like an ent…

Basically enable RBAC and “Add Permissions in the Access Token”.