从未经授权的客户端保护Angular / Spring REST Web服务的安全

Question

We are developing an application using Angular and Spring. We expose some REST web-services from back-end.

I know that it is highly recommended that REST web-services should be stateless and sessionless, so we are developing the webservices stateless and sessionless.

How can we protect the web services from being called from unauthorized clients. So I want these services just being called from the Angular application.

I know it is almost impossible to prevent calls from some tools like Selenium, but that's okay, cause that client is also the Angular app.

Answer 1

1. Develop a new authentication endpoint with Spring Security. Upon success authentication, return a JWT token with body containing generic data to feed your Angular app (like username, user profile, etc. but not password). You might want to persist the token in SessionStorage/LocalStorage to be shared among Angular component/route. (or perhaps shared with a common Service)

2. Every single call from your your Angular to server need to send along the JWT token in previous step as a Authorization header. In Angular, You can implement this shared logic with HttpInterceptor instead of putting it all over the places in your Angular services layer.

   You backend have to check the existence of this JWT token for every single request (Spring Security Filter), validate token header & signature with JWTUtil (io.jsonwebtoken) java lib. Also extracting JWT body to know which user is requesting the data & perhaps just return relevant data for this user based on his role (authorization)