I have an app using angular and when deployed to a server, everyone can ofc download the source codes, obfuscated or not.

Yet, I would like to prevent user that are not authenticated to see the source code of the core application. Since right now, the login is made on the real app, they have access to everything.

I was planning on making a static page that serve as a portal, where user authenticate, and separated from the main app.

After login, you would receive an email with an url (would be hosted on the same server) and a token, that would bring you to the main app.

The server would verify the token (is this possible with nginx?) BEFORE serving any file from the main application.

Then, when an user is connected, since he is server the real app, but he is connected, I would not care if he as the source code access.

Is this secured enough? Is this doable using nginx?

  • 2
    Why the email? There are things like sessions & cookies. Apr 24, 2020 at 6:41
  • 1
    To address your original problem you could prevent the full app download before login by using code-splitting and lazy loading.
    – AlphaD
    Apr 24, 2020 at 7:23
  • @AlphaD lazy loading would work ? Like loading only the login page at first, and lazy loading the rest of the app while logged in ?
    – Crocsx
    Apr 25, 2020 at 2:09

2 Answers 2


There is no practical or effective solution to this problem. The site is fundamentally run on the client side so whoever accesses it, will have to be able to pull the code to run it (as you mentioned) and will be able to distribute the content.

Yes you can use techniques such as that which you described. There's simpler ways though, a simple authentication portal written in a different platform or served as a different pre-authentication site that would either enable access to the angular site or not depending on the user having a valid session or not. Enabling access in this case would require validating authentication, so it would not be a plain redirect to a previously undisclosed URL - instead a piece of code could act as a reverse proxy and pass access to the angular site. Or conversely whichever control is in place, it should never rely on the URL for the angular site being unknown to unauthenticated users; This is not effective.

nginx would be able to validate authentication headers and things like that, but you really want all that to be implemented by application code and not the serving platform if at all possible.

  • it would redirect, but if you happen to know the real url without passing trough the portal, how would you prevent user to get the app ?
    – Crocsx
    Apr 25, 2020 at 2:12
  • 1
    yes, by redirect I didn't mean just forward to a hidden or undisclosed URL, that won't work as you rightly pointed out. access needs controlling using sessions or some other technique. for example the angular site could be fronted by a piece of PHP code acting as a reverse proxy once authentication is successful. (edited the response to clarify this)
    – Pedro
    Apr 26, 2020 at 20:36

I agree that there is no great way to do this, but another option is to require authentication for those assets through your backend application. You can use NGINX's X-Accel-Redirect to still serve them using NGINX, but only after making a request to your application that returns the correct headers internally.

  • But you would still be able to access those file if a unlogged user happens to know the URL that logged user are beeing redirected to ?
    – Crocsx
    Apr 25, 2020 at 2:11
  • 1
    @Bobby no, it's an internal redirect only. The pages aren't directly accessible; your application must respond to an authenticated request with the aforementioned header to make NGINX serve it. Apr 25, 2020 at 4:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .