Make your SPA a maximum security prison

Everybody has been creating Single Page Apps lately. They look neat and fast. Handling authentication in an SPA can be tricky though: Cookies, Tokens, Right to access URLs and Resources. Which one is better? In this talk, I explore all these options: pros and cons. We’ll use AngularJS as an example but the concepts apply to any other client technology like Ember.js or vanilla JS.

Transcript

1. Make your SPA a maximum security prison
2. @woloski @mgonto CTO & Founder Auth0 Dev Advocate Auth0
3. Identity made simple for developers
4. Authentication for Modern Applications using Tokens angular-­‐storage
 ! angular-­‐jwt
5. Browser Web Server auth C C Most of the web
6. Browser Web Server (Python) Realtime (Node) C M modern apps
7. Browser Web Server (Python) Realtime (Node) C M ! Cookies are coupled to the web framework modern apps
8. Browser Web Server (Python) Realtime (Node) C M API (Node) A Phones Tablets A modern apps
9. Browser Web Server (Python) Realtime (Node) C M API (Node) A APIs don’t use Cookies Phones Tablets A modern apps
10. Browser Web Server (Python) Realtime (Node) C M API (Ruby) API (Node) A A Phones Tablets A modern apps
11. Browser Web Server (Python) Realtime (Node) C M API (Ruby) API (Node) A A FIREBASE F Phones Tablets A modern apps
12. Browser Web Server (Python) Realtime (Node) C M API (Ruby) API (Node) A A ! Cookies don’t “flow” FIREBASE F Phones Tablets A modern apps
13. A better approach Token-based Authentication JSON Web Tokens
14. auth0/angularjs-jwt-authentication-tutorial Demo time!
15. Browser modern apps Web Server (Python) Realtime (Node) API (Ruby) API (Node) AWS S3 Phones Tablets
16. 5 t-shirts Bitcoins Stickers Thanks!