One-page apps: auth token management and browser updates

Question

When working with an Angular application, I have a one-page application that communicates with the JSON web service for data.

The "login" in my Angular application really just exchanges the username / password for the token. This token is passed as the header for all subsequent requests, so the server can resolve them. This works fine until users refresh their browser window, of course (via updating or exiting the "page" and returning).

Obviously, one option would be to force the user to reenter their username / password, but this seems like a good way to not have users.

I can think of 4 options:

• Save the token in a secure session cookie. (What I'm doing now, I use only what the client can read. Not used or required on the server.)
• Save token using local storage. (It will be unsafe and manual expiration manual maintenance is required.)
• Prevent the user from updating the browser using the "onbeforeunload" code. (I don't like it when I get “are you sure you want to leave this page”, and I assume that others feel the same way.)
• Include the token as part of the URL. (The URL may look large and messy. There may be a physical security risk. You can do more work with bookmarks and expired tokens.)

Is option 1 the best option for this feature? Is there anything better than all this?

Answer 1

I think option 1 is the best for your use case. All major web frameworks support this option.

If you need to handle this manually, you need to do the following:

• The web service processes the initial authentication request, creating and setting a secure authentication cookie. The auth cookie should be time-based (valid only for a specific time interval), and its value should be a unique value, if possible;
• After the initial authentication request, all subsequent requests automatically send an authentication cookie with the request header - this is processed by the browser.
• The web service should handle cookie authentication on subsequent requests by checking the cookie value and returning an error if the cookie has expired.
• You need to make sure that the global client-side authentication handler captures any authentication exceptions and displays a friendly message for the user.