How to achieve a Safe (!) authentication system in an angularjs app?

You cannot authorize anything in angularjs, because the user has full controll of the execution environment (namely, the browser). Each check, case, if – anything you can think of – can be tampered with. There are javascript libraries that use asymmetric keys to perform local encryption to store local data somewhat safely, but they are not what you are looking for, really.

You can, and you should, authorize things on the server – the standard way you would do it in an ordinary application – using session; no special code is necessary, ajax calls use ordinary session cookies. Application does not need to know whether it’s authenticated or not. It only needs to check what server thinks.

From the perspective of your angularjs application, being “logged in” or “logged out” is merely a gui hint for the user.

Leave a Comment

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)