Angular rest 身份验证安全吗？

Question

I am looking to connect to a secure REST service via Angular and have found the official way to do this is to set the authentication ticket as follows:

$httpProvider.defaults.headers.common['Authorization'] = 'dhfkssksk';

However isn't this insecure as anyone can simply view the JavaScript and find out the auth code?

Answer 1

If you mean that your client app is connecting directly to your backend api (ie no 3rd party services), then the short answer is yes .

However, there are a few considerations you need to take into account:

1. You must only send this ticket to your backend and nothing else. Ie set an HTTP filter in angular that acts on every client-side request and only sends this Auth header if the URL matches your API url.

2. You need to use SSL, to protect the token during transmission.