title: Storing custom user roles in JWT for use in React SPA?
body: <p>I am very new to React and separation of frontend / backend development (previously my apps are all coupled together e.g. ASP.NET website). Recently i am building a pure React SPA as my frontend, .NET CORE as my backend, ADFS 4.0 as my intranet auth server and my user roles are stored securely in OracleDB.</p>
  
  <p><strong>My current design is as follow:</strong> </p>
  
  <p>1) React app will acquire an access token from ADFS with the user claims (using react-adal)</p>
  
  <p>2) React app will call my Core backend with the Bearer token; backend will handle the JWT and check against ADFS</p>
  
  <p>3) On authenticated, user role will be retrieved from the database</p>
  
  <p>4) Role will be returned to React app either as a JWT or user object</p>
  
  <p><strong>Questions:</strong></p>
  
  <p>1) Should i store the user role in a brand new JWT that i craft myself (and signed with my own certs) from my Core backend (I mainly need the role for routing such that admin can access admin features while normal users can't). I protect my Core endpoints with the Jwt Bearer attribute so i reckon that i will craft my own Jwt token for my API backend to consume.</p>
  
  <p>2) Supposing that i am using the Jwt token to store my user role for my React app to consume, should i store the JWT in the sessionStorage such that the token will be removed along with the session when the user close the web browser? Given that the session will be destroyed when browser is closed, i can set the JWT exp time to a longer period, let's say to expire at the end of the day?</p>