I am trying to figure out a strategy for secure authentication - without re-inventing the wheel, but also considering the specific constraints of my situation. The strategy should not be tied to a particular framework - although I am looking at a node.js server with a REST API, serving an Angular web-app and also supporting server side rendering / Angular Universal - if that matters.
- in a second step, the full web-app (e.g. Angular) is downloaded and replaces the pre-rendered page with the app. From now on, we are running a web-app
We can also assume the server to use https/ssl. At least here, I have full control. I do not currently need support for external / 3rd party authentication or a separate auth-server.
In general, I ran into the following strategies:
- Basic authentication over https.
- Pro: requires nothing on the client side
- Con: may not be entirely secure
- Upon authentication, the server issues a token (e.g. JWT or some other token) which is stored as a Cookie with "HttpOnly"+"Secure" flags to prevent it from being stolen via XSS. To also prevent XSRF/CSRF, the server would issue a XSRF-token which the client (app) needs to attach to prove the origin of the request
- Pro: seems to be very secure
- Upon authentication, the server issues a token (e.g. JWT or some other token) which is stored in LocalStorage and the client app needs to attach it to every request. Need to make sure that no XSS attack is possible to prevent the token from being stolen.
- Pro: secure if XSS can be prevented. Does not require Cookies.