A 7 minute guide to SESSIONS and COOKIES for authentication in Angular

If we want our applications to be secure then we need to make sure our backend is secure. Before we send any data to a user, we want to make sure that they are authorised to receive that data. Sessions and cookies are a great way to facilitate this and has been the backbone of many authentication approaches for a long time.

NOTE: Do not use this in production, it is not secure

0:00 Introduction
1:11 Route guards are not secure
2:17 Securing backend endpoints
3:00 Implementing sessions
3:37 Handling logins
4:24 Creating a session cookie
5:35 Configuring Angular to send cookies

#angular #golang #authentication

[yousafraza]

Finally someone spoke on this taboo project. Much appreciated

[TayambaMwanza]

Ey, you made this video just in time for me.

[Karamuto]

Great video! We are using keycloak in out project so I was pretty familiar with the concepts used here. Even no one should implement this stuff themselves its still good to know the basics of it.

[nathanalberg]

Just an FYI, I had just spent a good chuck of time at work moving our sessions to cookies... only to have to trash it all.. since part of our application is served up inside an iframe on various client sites. You're kinda hosed if you need a persistent a session from within an iframe and you're using cookies. Chromes gonna kill 3rd party cookies and safari already did. There are "fixes" (CHIPS etc)... but none of their fixes will allow you to create an actual persistent session for your iframed domain.

[johalternate]

One thing I would like to add in case someone is confused, the "withCredentials" option wont allow angular (or any other JS) to read httpOnly cookies, it only instructs the browser to send the cookie values in the request.

[rembautimes]

Great video, and having worked in tech risk in a regulated corporate setting, I can say that not many vendors know about this. Will be great if you can expand on design principles to mitigate other OWASP vulnerabilities, this of course being one of them.

[jonathangamble]

More on resolvers, SSR... may need Analog or NestJS for endpoints

[dotnetapp]

I would like to see a Video about your folder structure for "bigger" Angular Projects, i'm never satisfied with mine :P

[colinwilliams]

Thanks for the great video! I'm also looking into cookie/session-based auth for an Angular app. I know the point of this video was how auth should work outside of a route guard, but how *do* we create an effective route guard for cookie/session-based auth?

Simply checking for the existence of a session cookie isn't 100% sufficient because that session could be expired. It seems that the only way for the client to know if a session is valid is through trial and error. For example, if we have a session cookie, but the session is expired, our app might still assume the user is logged in, so it tries to make an API call. An HttpInterceptor could then catch the 401 response set the auth state to 'unauthenitcated' and redirect back to '/login'.

Am I missing anything? Is there a simpler way to handle this other than the "trial and error" approach outlined above?

[rafaelcevallosdelamora]

If you need to retrieve the user information after a successful login, how would you chain the request to react to the "authenticated" status? Is it ok to put it inside the effect function?

[CarltonLeatch]

I'd like to ask, why arent you using angular-auth-oidc-client or openid-client packages that are made to do authentication to backend?

[md.redwanhossain]

Now this solution is vulnerable to CSRF attack.

[tangocukedi]

i guess this applies to access tokens as well