AngularJS - Handling refresh token?

Question

I'm building a SPA with AngularJS with communication to a service (JAVA).

When user sends his username/pass, service sends back both: Acces token and Refresh token. I'm trying to handle: if I get response with status 401, send back refresh token and then send your last request again. I tried to do that with including $http, but angular doesn't let me include it in this interceptor. Is there any way to recreate the original request with this response parameter I'm recieving?

Something like:

I get 401
save my request
if I have a refresh token send that refresh token
on success resend my request

on error redirect to /login page

'use strict';

angular.module('testApp')
    .factory('authentificationFactory', function($rootScope, $q, $window, $location, CONF) {

return {
    request: function(config) {
        config.headers = config.headers || {};
        if ($window.sessionStorage.token) {
            config.headers.Authorization = 'Bearer ' + $window.sessionStorage.token;
        }
        console.log(config);
        $rootScope.lastRequest = config;
        return config;
    },

    response: function(response) {
        console.log($rootScope.lastRequest);
        if (response.status === 401) {
            if ($window.sessionStorage.refreshToken) {

                //Save, request new token, send old response
                //if it fails, go to login

                $location.url('/login');
            } else {
                $location.url('/login');
            }
        }
        return response || $q.when(response);
    }
};
});

Bonus Question (the main question is more important): There are 2 mobile apps that will also connect to my service, and when I log in from my web app, and few moments later from my mobile app, mobile app takes a new refresh token and my web app's refresh token is valid no more. What would be the best option for dealing with that?

Thank you for your time, Best regards

Hi @dyslexisDcuk, you got any success on that please share with me. Thanks — MUHAMMAD MUBUSHER ASLAM
– MUHAMMAD MUBUSHER ASLAM, Commented Apr 14, 2017 at 4:50

Sam · Accepted Answer · 2014-04-29 14:18:08Z

12

Have a look at this: https://github.com/witoldsz/angular-http-auth.

He uses a buffer to replay the requests after authentication.

answered Apr 29, 2014 at 14:18

Sam

15.8k26 gold badges89 silver badges151 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

damirsehic Over a year ago

Brilliant! Will test it out later and get back to you, thanks a lot :)

damirsehic Over a year ago

It didn't really answer my question but it did take me in the right direction. Thanks

Hugo Nogueira Over a year ago

So, what's yout final solution?

mateeyow Over a year ago

@DyslexicDcuk Mind posting your solution?

damirsehic Over a year ago

@mateeyow I'm really sorry but I switched companies a while back and don't have acces to that code any more.

jeanpaul62 · Accepted Answer · 2017-07-24 07:24:01Z

4

I would strongly advise against sending and storing refresh tokens on SPAs like Angular.

If you are using session storage or local storage, you are opening a window of opportunity for the this refreshToken to be captured, either by a XSS attack, or by the user leaving the computer unattended.

See this article or this question for more info.

answered Jul 24, 2017 at 7:24

jeanpaul62

10.7k15 gold badges60 silver badges103 bronze badges

Collectives™ on Stack Overflow

AngularJS - Handling refresh token?

2 Answers 2

5 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related