Authstronomy: The Science of Authenticating Angular Apps

on YouTube ↗25m

" summary

Recommends against don't store tokens in local storage and instead keeps tokens in app memory with a session cookie for silent reissues; advocates the IETF PKCE code exchange flow (code verifier/challenge) to avoid URL-delivered tokens, with SDKs handling the steps. Shows concrete Angular tools: RxJS streams for auth state, HTTP interceptors to attach tokens, and route guards including canLoad to prevent lazy modules downloading. Practical demos and code patterns are described and validated.

AI-written summary · about

" chapters (21)

1. 0:00Introduction
2. 0:53Cookies
3. 2:19How it works
4. 3:19Why not cookies
5. 3:54Securing with cookies
6. 5:14Tokenbased authentication
7. 5:43Local storage
8. 6:57Session persistence
9. 8:12OAuth2 guidance
10. 13:06How does Angular help us
11. 13:44Managing authentication events
12. 14:42Creating authentication streams
13. 15:19Conclusion
14. 15:49HTTP Interceptors
15. 16:14Provider Array
16. 17:05Conditional Logic
17. 17:39Asynchronous Authentication
18. 19:05Route Guards
19. 20:28CanActivate
20. 21:28GuardLazyLoading
21. 23:46Recap

" related talks

• 26mThe Science of Authenticating Angular AppsKim Maida · AngularUP 2019
• 30mThe science of authenticating Angular appsKim Maida · AngularConnect 2019
• 19mAngular's User Authentication Tool BeltKim Maida, Ryan Chenkie · ngAtlanta Conf 2018
• 27mCookies versus tokens: a paradoxical choicePhilippe De Ryck · NG-BE 2017
• 28mA Token Walks Into a SPA...Ado Kukic · ngVikings 2018
• 33mMake your Angular app a max security prisonMatias Woloski, Martin Gontovnikas · ng-europe 2014
• 30mStandards-based authentication for JavaScript sitesKim Maida · backendlessConf_ 2019
• 32mAngular and the OWASP top 10Philippe De Ryck · NG-BE 2018