We are designing a web site for selling financial products online.
The following is a high level description of the components:
- Our frontend will be a SPA built with AngularJs.
- The frontend will communicate with an API hosted in Heroku.
- The API will expose web resources which allows the execution of the business process.
- The API hosted in Heroku serve as a passthrough between the frontend and the real services which actually do the tasks.
- The purchase process is designen to not ask for user/password or account creation at any point.
We have some queries we execute thru the API which returns confidential information -confidential according to the local law-
We want the frontend to authenticate to the API to retrieve this information still NOT asking for credentials to the user.
We thought about a local persistence of the credentials and obfuscating the request but that would be easy to break with a proxy so the request can be read clearly.
What would be an option for this need of authenticating the frontend without asking for credentials to our clients?