How to find out if a user is registered with a .js passport by subdomain

Question

I created two Mean.io applications in the .com domain and in sub.domain.com respectively, and everything works as expected in both, but the problem is that the one that is in the subdomain (sub.domain.com), should know if the user is registered in the main application (domain.com).

I know that the passport processes the sessions and knows if the user is registered, because he creates a user object in req for each request in express.js:

if (req.user) { // logged in } else { // not logged in } 

The inconvenient thing here is that this approach works from the inside of the domain, but not from the outside. In other words, if I make a backend request as follows:

 $http.get('/api/users/me').success(this.onIdentity.bind(this)); 

from domain.com, it will be filled with user data, but if I make the same request directly from the browser, for example, it will return null.

I need to understand how to transfer this information across domains? And if every time this request is executed $http.get('/api/users/me').success(this.onIdentity.bind(this)); Is the information transferred to the backend?

Answer 1

I found the answer after deep research.

Short answer: it is impossible to use localStorage (data is available only to the domain, even for subdomains), which is the tool Mean.io, which is now used to store user information.

Long answer, every time you log in, you send a request to the backend, angular intercepts the request before sending it (this message explains this https://auth0.com/blog/2014/01/07/angularjs-authentication-with -cookies-vs-token / ) and adds the authorization header as follows:

 headers: { ... authorization: 'Bearer eyJhbGciOiJIUzI1NiJ9.JTdCJTIyX2lkJTIyOiUyMjU1ZDFjYmIxNDA..._rUsUBFxCQy3qqUGi9QGVD0YXCEk0', ... } 

which subsequently uses a passport to serialize user information into the session and put it in req.user. The token carrier is stored in localStorage and for this reason it is not possible to retrieve it from outside the domain. The only way I came across was to use cookies with domain = '.domain.com' so that each subdomain could read these cookies.