I would like to allow users of a website to be able to log in at any page.

In order to provide a seamless experience my first thought was to collect user credentials (username and password) in a dynamic form and then authenticate the user through an API call (https) performed using Javascript.

However I am not confident in the security of this approach.

Is this a secure scenario? What are the potential vector attacks? Which are the best alternatives?

[edit to provide further details]

From @Xander's answer I get that calling an API from javascript is not insecure per se. Yet I would like to know how to set a login cookie securely after a successful call to the API


closed as too broad by schroeder, Eric G, Graham Hill, RoraΖ, Stephane Apr 9 '15 at 15:23

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    What you are really asking for is an Authentication process. There are many well-established ways of doing that depending on your technology/language. Please consult the fine folks at stackoverflow for direction. – schroeder Apr 8 '15 at 21:22

So, the basic scenario you propose is to send credentials from a browser, to your web server. So, we're dealing with HTML and Javascript and associated assets in the browser, and the communication is over HTTP/HTTPS. These are the only components relevant to the specific function in question.

And in fact, the fact that you're using JavaScript to send the credentials to an API endpoint vs using an HTML form to post them back to a page is in itself materially irrelevent.

The only two points we're particularly worried about here are:

  1. Is the content (HTML, JavaScript, assets) that is delivered to the browser genuine? In other words, will the user get the HTML and JavaScript that we intended to send, that will in fact then send the credentials to our web server, and not to an attackers web server?
  2. Are the credentials the user sends to our API secret and secure?

The way to answer "Yes" to both of these questions is HTTPS. This means that not only must you use HTTPS to send the credentials to the API, but you must also use it to deliver the login page, the JavaScript for the login page, and any other assets on the login page to the user, so it can't be modified by an active attacker.

So, for this function of very limited scope, if you use HTTPS and HTTPS alone to secure the transmission of all data in both directions, it will be secure.

  • Thanks Xander. Do you know if setting a login cookie using Javascript after a successful API call is secure? – securityCurious Apr 9 '15 at 17:29
  • @securityCurious No, not particularly, because an authentication cookie should be marked as HttpOnly, to prevent it from being stolen in the event of an XSS vulnerability being discovered in the application. Since HttpOnly cookies are not accessible to JavaScript, they cannot be created with JavaScript either, generally speaking. – Xander Apr 9 '15 at 17:51
  • So the weakest point is storing the authentication state in the browser? – securityCurious Apr 10 '15 at 22:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.