app.routing.ts: Making use of isAdmin

[agrawalarpit14]

Enforcing isAdmin is true to route to
/#/administration

Part of #336

[agrawalarpit14]

The flow of the challenge can be seen here.
Hi @bkimminich Please let me know if you want any changes to be done and if I can start to write tests?

[bkimminich]

Looks good to me, but I think other than making the "Admin Section" challenge ⭐⭐ instead of ⭐ there's no additional new challenge to be made out of this, because there's already multiple ways to elevate privileges to get to the Admin page.

[bkimminich]

We could instead make this a new challenge "JWT Tier 0.5" (:star::star::star:) with description something like "Become an admin temporarily. (Do not log in as an actual admin user)" ... To verify we could check if the JWT has isAdmin=true but the mentioned user account is not really an admin in the Users table.

[agrawalarpit14]

Hi @bkimminich It sounds great. Then I will go on building the challenge "JWT Tier 0.5" and about this if there is no change can I start writing the tests(solving it in a way where user uses an admin account) ?🤩

[bkimminich]

Ah, sorry, I just re-watched your video in better resolution and saw that you actually used the same attack needed for "JWT Tier 1" to manipulate the admin flag in the token. So, no new challenge here, I guess... I'll merge your change as is and just increase difficulty for "Admin Access" challenge by 1. Thanks a lot for adding a first step of role-based authorization via JWT to the Juice Shop! 👍

[lock]

This thread has been automatically locked because it has not had recent activity after it was closed. 🔒 Please open a new issue for regressions or related bugs.