The science of authenticating Angular apps

on YouTube ↗30m

" summary

Explains concrete recommendations: use PKCE code flow so the browser receives a harmless code then redeems it for tokens, avoid don't store tokens in localStorage and keep tokens in memory while using an auth-server session cookie to silently refresh, use RxJS observables and available SDKs to wrap callbacks/promises, attach tokens with HTTP interceptors, and protect routes with guards including CanLoad to prevent lazy modules from downloading when unauthorised; ag-Grid is listed as sponsor.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 1:13Authentication
3. 4:24Why not cookies
4. 5:09Crossorigin
5. 7:05Tokens
6. 10:16OAuth 20 history
7. 15:31Should you use OAuth 20
8. 16:17How does Angular help
9. 17:08Managing authentication events
10. 19:55Sending the token with API requests
11. 23:35Route guards

" related talks

• 25mAuthstronomy: The Science of Authenticating Angular AppsKim Maida · ngVikings 2019
• 26mThe Science of Authenticating Angular AppsKim Maida · AngularUP 2019
• 33mMake your Angular app a max security prisonMatias Woloski, Martin Gontovnikas · ng-europe 2014
• 30mStandards-based authentication for JavaScript sitesKim Maida · backendlessConf_ 2019
• 19mAngular's User Authentication Tool BeltKim Maida, Ryan Chenkie · ngAtlanta Conf 2018
• 32mAngular and the OWASP top 10Philippe De Ryck · NG-BE 2018
• 17mThere's Safety in AngularAlisa Duncan · ng-conf 2022
• 39mLogin and Access Control in AngularManfred Steyer · Ng-Poland 2017