1

I need help to authenticate User with user credentials.

We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials after logout and refreshing the browser.

There are several ways to store user credentials(Cookies, Local Storage, Session Storage, IndexedDB, WebSQL). but these all are not secure.

we thought about storing user credentials in localStorage by encrypting it. but anyone can decrypt it so, this way is not secure.

Our targeted browser includes Internet Explorer, MS Edge, Safari, Google Chrome, Opera, Mozilla Firefox.

How can we achieve Client Side web Storage using JavaScript?

Thank you

  • 1
    A standard exists what you want Web Authentication: An API for accessing Public Key Credentials ... also explained more easy -> webauthn.guide .. i believe the browser support are the modern Firefox, Edge and Google chrome and thats about it.. – Raymond Nijland Oct 4 at 14:56
  • 1
    .. the other option which is less userfriendly is using WebCrypto API in javascript and a server side code library to sign client ssl certifications which could be used to verify the user.. The userfriendly part is that a user needs to install the certificate by hand...in the past there was a html 5 tag <keygen> which did the same it's most likely now removed in most browsers... – Raymond Nijland Oct 4 at 15:06
1

Anything stored client side (and not encrypted) can be seen and/or modified by the user.

The usual way of implementing a "Remember Me" functionality is to set a cookie with an encrypted username, sent from the server.

The server will encrypt the username with a secret key, known only to the server, and set a cookie with that value. When the server later receives that cookie, it can try to decrypt it, and if successful, log the user in. This cannot be tampered with by the user, as they do not know the secret key.

  • but this will autofill the data when the user came back after the logout. – Parth Raval Oct 4 at 10:48
  • 1
    Why would you want to autofill the login data? With the above method, you can skip the login stage altogether and go straight to a logged in user. – Chris Murray Oct 4 at 11:01
  • The Functionality I want , After Logout when user come back to that login page all that users data will be auto-filled. – Parth Raval Oct 4 at 11:03
  • 1
    There is no way to do this securely on the client side. If you have all the information required to decrypt the details, so does any user local to the machine. You are trying to implement a password manager, for a single site, purely in JS. It's not possible, or useful. – Chris Murray Oct 4 at 11:22
  • 1
    They do it as I described above. A secret sent from the server, that can later be re-verified and log the user in. At no time is the username/password stored anywhere on the client's machine. – Chris Murray Oct 4 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.