javascript - Express.js and Angular - authentication and login session -

i'm using expressjs , angularjs app. basically, expressjs returns 1 .html has angular single-page-application. routing done angularjs, , expressjs exposes web services (get, post).

so, if i'd regular expressjs app, i'd use passportjs , store user in session on server-side that'd it. when user tries access /admin pages, i'd use passport middleware check if route allowed , forth. plain , simple.

but angular, routing done on client side - evaluating if user logged in. now, of course, lot has been written this, solutions store kind of token key in localstorage or angular's $cookie. i'm wondering - safe?

if ran such application on public computer, , forgot logout, able @ localstorage or angular's $cookie , token, right?

so theoretical process of implementing safe authentication on client side, using angularjs?

quote:

so, if i'd regular expressjs app, i'd use passportjs , store user in session on server-side that'd it.

while session data stored on server, session identifier stored on client in cookie. if cookie stolen (such in public computer example), session can used else. client-side applications can use cookie-session-identifier scheme. when angular makes xhr requests of server, supply cookie.

as you’ve seen, json web tokens (jwts) have emerged new scheme. replace session identifier, not cookie. may see local storage being used instead, not safe. cookies in fact secure place store authentication token, if set httponly; secure flags. prevents js environment reading cookie, , prevents browser sending server on non-secure channels.

i’ve written jwts , angular apps @ length, in these 2 articles:

build secure user interfaces using json web tokens (jwts)

token based authentication single page apps (spas)

if you’re concerned public computers, have avoid storing token altogether. means retaining token in javascript memory, , supplying via http headers (typically authorization: bearer <access_tken>). tab closed, token lost , session dead. of course requires user close tab, can take step further , set low “time idle” on token, such 5 minutes. if user not use token within 5 minutes, considered in valid , have login again.

p.s. work @ stormpath , have user management service makes incredibly easy add authentication angular apps. can read in our angularjs guide