Hello ionic people,
There is a question that needs Good Thinking, it has a code part and and Ionic API service part :
In an App that uses the Ionic Users service (Basic and social providers), in the front end the authentication is done easily based on the guide line provided and everything is fine:
Ionic.Auth.login('basic', authSettings, loginDetails)
.then(authSuccess, authFailure);
But if the app has a back-end server (let us say NodeJS), the backend server has an APIs that receive requests from the front end client, these requests should be authenticated.
In a normal life case, what we do is the following (without using the Ionic User Service):
- When the user login, our backend server will create a JWT token (on the server) with some secrete code and then send it to the front end client.
- The front end client will send that JWT to backend attached with each request,
- The backend will verify the JWT on the server (as it has the secret code for it), and then process the request.
Now back to my app how can we apply this logic when using Ionic Users Service?
I almost searched every page about Ionic users service in the internet, without any clue about the correct logic!!
I believe Ionic.Auth should work in this flow (i am not sure if it do it now or not)
1- When Ionic.Auth.login(), the JWT should be generated using a secret code that exist in the App 1-Dashboard, so the developer can use it later to verify the requests on his backend server
2- In the callback of Ionic.Auth.login(), it should return the JWT, (now the developer save this JWT in local storage to use it with future requests to the backend server)
Now is developer role
3- When an API request is issued to the backend, it will attach the JWT with it
4- The Backend will verify the JWT and make sure it is correct using the the secret code that exist in the App Dashboard
Please give your opinion on this, and how can we solve it using the service or the code?
Regards