1
Unlike PHP, Angular is a frontend framework. All frontend code is visible to the end user.
All network calls are also visible to the end user, even if it's encrypted with HTTPS. Encryption will only protect against man-in-the-middle attacks. An IP whitelist will not.
Although only a whitelisted IP can successfully receive data back from the REST service, ...
1
When that link is clicked, an authentication page would show up in the machines internet browser and show a page where it asks for the user's company ID and birthday.
This is not a safe on-boarding process to prove that a new app user is associated with an identity in active directory. Birthday and company ID are way too public, particularly to other users ...
1
The answer to your question will be opinion based.
In my opinion, the password should confirm that the requester is really the owner of the user ID he sent in the request. If one would treat API as a password, what user ID would it confirm? That's why I treat API in such scenario (Basic Auth) as a user ID. And this user ID is so secret that knowing it ...
1
My understanding is the real issue is cookies that store the auth credentials because the browser automatically sends it to the URL. If you don't use cookies and don't have some script that always sends auth data on request, you don't need the anti-forgery token. It doesn't make sense to ever use it if you think about it. If you just use a JWT token or some ...
Only top voted, non community-wiki answers of a minimum length are eligible
