1

For our app when a user logged in we are issuing him a token which is stored in session and we are using $rootScope to store his details.

This what we are doing

if(sessionStorage.loggedIn && sessionStorage.token){
  addonService.get({
    customer_token : sessionStorage.token
  }).$promise.then(function(data) {
        $rootScope.user = data.user;
        $rootScope.address = data.address;              
  });
}

Is this procedure safe? Is there any way hacker can hijack user variable from $scope? If this is not the best practice how can I make my code better?

1 Answer 1

2

While the question is specifically about AngularJS the issue lies in the fact that anything that is completely controlled and executed on the client side cannot be trusted. For anything that is accepted from the client side MUST be validate on the server before use. That is the only way to feel relatively confident about the operation.

Modifying the $rootScope or ANY object on the client side is trivial as an activity. The easiest way to do it is to open a session of firebug and use the console tab's script runner section to arbitrarily change any field or add/remove any field in any object.

Let alone angular - it is possible to even override (or replace) some methods of the window or other built in objects using this technique.

So bottom line validate on the server do not trust operations and inputs that run in the client space.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .