Does ngx-cookie-service a complete way to do authentication for Angular Universal apps

Question

I'm building an Angular Universal MEAN (MongoDB, Express, Angular, Node) app, but I'm looking for the correct way to handle security. I know you can't use localStorage with Angular Universal. Is ngx-cookie-service a complete way to handle security, authorization, etc.? Would implementing something like this...

https://www.npmjs.com/package/ngx-cookie-service

...or this...

https://itnext.io/angular-8-how-to-use-cookies-14ab3f2e93fc

Do cookies replace using tokens?

Would it replace code like this in app.js on the backend:

    app.use((req, res, next) => {
  res.setHeader("Access-Control-Allow-Origin", "*");
  res.setHeader(
    "Access-Control-Allow-Headers",
    "Origin, X-Requested-With, Content-Type, Accept, Authorization"
  );
  res.setHeader(
    "Access-Control-Allow-Methods",
    "GET, POST, PATCH, PUT, DELETE, OPTIONS"
  );
  next();
});

app.use("/api/posts", postsRoutes);

And this on the backend...

const jwt = require("jsonwebtoken");

module.exports = (req, res, next) => {
  try {
    const token = req.headers.authorization.split(" ")[1];
    const decodedToken = jwt.verify(token, process.env.JWT_KEY);
    req.userData = { email: decodedToken.email, userId: decodedToken.userId, isAdmin: decodedToken.isAdmin };
    next();
  } catch (error) {
    res.status(401).json({ message: "You are not authenticated!" });
  }
};

If you have a link to a good example of the code for a simple MEAN stack Angular Univeral app demonstrating the correct way to use cookies, please share. Or perhaps an article with the broad strokes explained if it is a complex explanation. Thank you for your time. It's greatly appreciated.

K

score 0 · Answer 1 · answered Feb 14 '20 at 11:28

ngx-cookies does not provide a 'complete' way to perform authentication, just an easy way to set/get cookies when using angular universal.

In your backend, install and use cookieParser

const cookieParser = require('cookie-parser');
app.use(cookieParser());

Then, instead of getting your jwt from a custom Authorization header, get it from the cookie

const token = req.cookies.authorization.split(" ")[1];

Does ngx-cookie-service a complete way to do authentication for Angular Universal apps

1 Answers1