Oauth 2.0 token based authentication

tutorials
21

And: http://robferguson.org/2015/07/27/authentication-for-ionic-apps/

1 Like
22

send it via query string

23

Could you help me to solve this problem?

Thanks before

24

Hi everyone, i know that this is a old topic, but i was working with some similar issue, but the the real problem is that implement the request for token with client_id and secret_id credentials from angular (or other client side method) is a bad practice. This exposing the app’s oauth credentials and will available from local source (browser console and JS source).

Then the best practice is make that request in server side and implement basic authentication form in your angular app (of course provide a SSL certificate for user send their data is safe way).

On server side depend of your favorite language (PHP, Python, Perl, Ruby, …) and response the token to the angular app with other data that you required.

The basic flow is:

  • Angular app send user credentials to server “username and password” (Post Method over HTTPS)
  • Server app get the user credentials and OAuth credentials of your app (ex. twitter app) that are stored in a safe place (not public)
  • Server app request the token to the authentication system (OAuth provider) and get de Token data.
  • Server Response to Angular app the user token.
  • Angular app save the token on localStorage, cookies and use it in Headers request.

Other aspect to consider is that OAuth provider response with a refresh_token, that will be use for renovate a token that is expiring. You should implement a safe method to store that token and use it to refresh the user token.

Is someone need a full example working code, please write me and i will provide the source.

25

Please provide the source as that would help all of us. I am trying to implement oauth on ionic2.

26

Alright this case works, how would a refresh token work, what if a user logs into the application after 3 days and both token and refresh tokens are expired by that, they would want to login again? This never happens to Facebook or Twitter apps so i wonder how they manage refreshing tokens.

27

@aryan7 Can u please share ur correct code with interceptor …