具有客户端路由的节点身份验证

Question

So I'm unsure of the practicalities of authentication on a SPA, as I try to get used to my new stack of choice.

I will be serving a Node/Express app, with all API routes on /api , and the frontend served on the root / (all routes will serve index.html , then the client-side routing will take care of the rest. So I have the backend authentication set up with the Passport library, which works well. But how does one keep the server and client sessions in sync? As well as taking care of security.

If I make a POST request to /api/login with credentials, what do I return in the response to the client? And where is the session set?

My frontend is Vue, so I assumed I would just pass the user data (if credentials are correct) to the instance and have a user object. But I'm guessing I need to store a token of some sort? (jwt?)

If someone could clear up how this client-server architecture works, that would be great.

Cheers.

Answer 1

Whenever user logs in with credentials you can send a JWT Auth Token and then store the token as Cookie/Local Storage.

Then send the token as Authentication Token in each request as Request Header/Data to validate the user.

Link: Here is a tutorial with NodeJS