0

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. Everything with AngularJS is client side, so I was wondering how to set the user ID without anyone being able to just change it and pretend they're someone else.

The way I'm thinking of doing this is that when a user logs in on my app, I create a random string on my server and hash it. I then send it to the app and store it both in the app's local storage and in the database on my server, and I have the app include it with all requests. This way, when someone makes a request I can just check that string they send is the one in my database; when a user logs out, I clear local storage and remove the string from my database. I create a new string when they next log in.

Is this a good idea? Maybe this is the normal way to go, but I couldn't find any free authentication solutions on the Internet. Since this app will probably have a lot of traffic, I'm not willing to pay for every connection to my server.

Improve this question
5
  • 3
    ...did you just reinvent a session token? – Dmitry Janushkevich Jul 11 '14 at 14:33
  • i'm not sure that's why i'm asking @DmitryYanushkevich is this how it works? – Sjoerd de Wit Jul 11 '14 at 14:33
  • It surely looks like it. Please read up on sessions and session tokens, that should solve your problem. – Dmitry Janushkevich Jul 11 '14 at 14:34
  • oke, so if it's that easy why would there be so many companies selling this and asking 40 dollars a month for 200 users, or even more and call it "enterprise" i'm baffled – Sjoerd de Wit Jul 11 '14 at 14:48
  • Selling what exactly? – Dmitry Janushkevich Jul 13 '14 at 8:36
1

The system you're describing sounds a lot like standard cookie based authentication/session management systems, in that you authenticate the user and then provide a session token to them which allows you to identify requests from that user for the duration of their session.

Whilst you could implement this manually, I would recommend against it, as there are quite a few potential pitfalls and things to know about getting session management correct and it would be easy to get it wrong and leave your application vulnerable to common session management attacks.

you haven't said what you're using to provide server-side logic for your application but for example if you're using something like Node.JS, then there are session management modules available in npm (for example Mozilla Client Sessions).

In general if you search for 'session management (your server-side framework)' I'd expect you'll find a number of modules which implement the needed functionality

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.