The Science of Authenticating Angular Apps

on YouTube ↗26m

" summary

Compares cookie sessions (use when front end and API share a domain) versus token APIs (use when APIs are cross‑domain) and recommends the IETF best practice of Authorization Code with PKCE instead of tokens in URL. Warns don't store tokens in localStorage and instead keep tokens in memory and use the auth server cookie to silently obtain new tokens. Shows concrete Angular implementations: RxJS streams for auth state, HTTP interceptors & route guards (canActivate, canLoad) and guarded lazy loading.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to authentication
2. 1:12Cookie-based authentication
3. 4:06Token-based authentication
4. 6:39Token storage security
5. 9:05Modern token exchange flows
6. 14:47Angular authentication to-do list
7. 15:28Managing auth events with RxJS
8. 17:17Sending tokens with HTTP interceptors
9. 20:10Restricting routes with guards
10. 25:10Summary and resources

" related talks

• 25mAuthstronomy: The Science of Authenticating Angular AppsKim Maida · ngVikings 2019
• 30mThe science of authenticating Angular appsKim Maida · AngularConnect 2019
• 27mCookies versus tokens: a paradoxical choicePhilippe De Ryck · NG-BE 2017
• 19mAngular's User Authentication Tool BeltKim Maida, Ryan Chenkie · ngAtlanta Conf 2018
• 30mStandards-based authentication for JavaScript sitesKim Maida · backendlessConf_ 2019
• 44mThe Art of Authentication for Web AppsKim Maida · Build Stuff 2022
• 59mSecuring Web APIs from JavaScript/SPA ApplicationsBrock Allen · NDC Oslo 2019
• 33mMake your Angular app a max security prisonMatias Woloski, Martin Gontovnikas · ng-europe 2014