Question

I’m new with angularjs…

I read the docs, and completed the tutorial; i also tried something else by myself, and things start to make sense to me.

Now i wonder how to make a safe authentication system.

The easy part: no code, i will describe operations my code execute:

I’ve a classic form: username, and password text input.

The user fills the form, and press ENTER.

An ajax request starts, and the response is a JSON telling me
something like “ok i know you” or “i don’t know who you are”.

What i need now is to mantain the logged status of the visitor (or not logged) between the different views of my application.

I read on the internet that, to achieve this objective, someone sets a variable ($scope.isLogged = true), someone else uses cookies; but javascript variables, and cookies can be easily edited using firebug, or similiar development tools.

… and finally the question:

So, have you some suggestion to achieve a safe authentication system in an angularjs app?

Answer 1

You cannot authorize anything in angularjs, because the user has full controll of the execution environment (namely, the browser). Each check, case, if – anything you can think of – can be tampered with. There are javascript libraries that use asymmetric keys to perform local encryption to store local data somewhat safely, but they are not what you are looking for, really.

You can, and you should, authorize things on the server – the standard way you would do it in an ordinary application – using session; no special code is necessary, ajax calls use ordinary session cookies. Application does not need to know whether it’s authenticated or not. It only needs to check what server thinks.

From the perspective of your angularjs application, being “logged in” or “logged out” is merely a gui hint for the user.