I need help to authenticate users with user credentials.

We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user credentials after logout and refreshing the browser.

There are several ways to store user credentials (Cookies, Local Storage, Session Storage, IndexedDB, WebSQL). but these all are not secure.

we thought about storing user credentials in localStorage by encrypting it, but anyone can decrypt it so, this way is not secure.

Our targeted browser includes Internet Explorer, MS Edge, Safari, Google Chrome, Opera, Mozilla Firefox.

How can we achieve client-side web storage using JavaScript?

  • 1
    A standard exists what you want Web Authentication: An API for accessing Public Key Credentials ... also explained more easy -> webauthn.guide .. i believe the browser support are the modern Firefox, Edge and Google chrome and thats about it.. Oct 4 '19 at 14:56
  • 1
    .. the other option which is less userfriendly is using WebCrypto API in javascript and a server side code library to sign client ssl certifications which could be used to verify the user.. The userfriendly part is that a user needs to install the certificate by hand...in the past there was a html 5 tag <keygen> which did the same it's most likely now removed in most browsers... Oct 4 '19 at 15:06
  • This is normally not how "remember me" functionality works. Normally, "remember me" either gives you a session that is valid for a longer time, or another token that can be exchanged for a valid session. This way, there is no need to remember the password, but only to remember the authentication token.
    – Sjoerd
    Apr 16 at 13:34

Anything stored client side (and not encrypted) can be seen and/or modified by the user.

The usual way of implementing a "Remember Me" functionality is to set a cookie with an encrypted username, sent from the server.

The server will encrypt the username with a secret key, known only to the server, and set a cookie with that value. When the server later receives that cookie, it can try to decrypt it, and if successful, log the user in. This cannot be tampered with by the user, as they do not know the secret key.

  • but this will autofill the data when the user came back after the logout.
    – Parth
    Oct 4 '19 at 10:48
  • 2
    Why would you want to autofill the login data? With the above method, you can skip the login stage altogether and go straight to a logged in user. Oct 4 '19 at 11:01
  • The Functionality I want , After Logout when user come back to that login page all that users data will be auto-filled.
    – Parth
    Oct 4 '19 at 11:03
  • 2
    There is no way to do this securely on the client side. If you have all the information required to decrypt the details, so does any user local to the machine. You are trying to implement a password manager, for a single site, purely in JS. It's not possible, or useful. Oct 4 '19 at 11:22
  • 2
    They do it as I described above. A secret sent from the server, that can later be re-verified and log the user in. At no time is the username/password stored anywhere on the client's machine. Oct 4 '19 at 11:30
  1. create a folder on your server (say, example.com/accounts)
  2. disable the directory listing (if there is one)
  3. create a php file that will be able to create new files on the server
  4. create an account screen
  5. use javascript to link the current page to the php

For example:

window.location.replace("create-username.php?action=" + 
document.getElementById("username").value + "&secret=" + 

Edit: prevent others from accessing info

Add .htaccess into the folder that stores accounts. (The php can access this folder)

Options -Indexes
Deny from all

Now follow Chris Murray's answer to store the data.

  • 3
    None of this is client-side. And this answer depends on quite a bit of magic in the line "use javascript to link the current page to the php" ... Doing that securely requires a lot of thought, and you will end up with a process to secure that step that could simply be used to secure a more well-used approach.
    – schroeder
    Apr 16 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.