I am creating SPA application using Angular. This will serve my two purpose for middle layer on mobile as well website.
Now trying to security my application from XSS, CSRF and also wanted secure authentication mechanism. My services will be Resful stateless services.
This is the flow which I think will help me.
- Client App send User ID, Password to server.
- Server validate the request and generate token which will get stored in db.
- This token = userId + Random Number + TimeStamp
- token will send back to client APP.
- client APP will store it in local storage or cookie.
- With every subsequent request i will validate the token with one store in db.
- Where should the token stored? Cookie or local storage?
- On server, token need to be stored somewhere. If stored in db that will increase load on DB.
- Since I am going to use AJAX request, how should I pass token value Header or body?
- Since this same codebase I will use for my website also, How secure is this approach for website?
- How to tackle CSRF attack in this case?