I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. Everything with AngularJS is client side, so I was wondering how to set the user ID without anyone being able to just change it and pretend they're someone else.
The way I'm thinking of doing this is that when a user logs in on my app, I create a random string on my server and hash it. I then send it to the app and store it both in the app's local storage and in the database on my server, and I have the app include it with all requests. This way, when someone makes a request I can just check that string they send is the one in my database; when a user logs out, I clear local storage and remove the string from my database. I create a new string when they next log in.
Is this a good idea? Maybe this is the normal way to go, but I couldn't find any free authentication solutions on the Internet. Since this app will probably have a lot of traffic, I'm not willing to pay for every connection to my server.