Angular 6-HTTP响应/可变篡改

Question

I developed an application using the MEAN stack, where a user can signup and login. When a user returns to the application after some time, I can recognize it using Express Session, but I want him to confirm its identity by typing the password (or a PIN) before giving access to the application.

So I make an HTTP call to an API (passing the password or pin) that will either return true or false to allow access to that page.

• Is it possible that someone intercepts the HTTP call (eg via DevTools), intercept the returned value and edit it, effectively bypassing the security check?
• Or even intercept the router variable and force a navigation to a specific page (not available otherwise)?
• Does Angular have in-built securities to prevent this, or do I have to implement it myself (in this case, what is the best practice)?

Thank you so much!

EDIT: As @bsheps pointed out, implementing AuthGuard solved the second point, about manually modifying routes to access reserved pages.
I still have to find an answer about the first point. Even when calling an HTTPS endpoint, can someone debug the code and the network requests to edit the response received from the server?

Answer 1

• About HTTP security:

HTTP is written in plaintext and not secure. If someone intercepts your communication (Man in the middle attack), they can read your password/pin in plaintext. Additionally, they could also edit it since it is plaintext. For this reason passwords should be sent via HTTPS.

• About angular router security:

It is possible to manipulate the routes in the URL. To combat this, you can setup an authGuard for your application that will verify the login before directing to specific pages.

Here is a straight forward example to get you started: https://alligator.io/angular/route-guards/

Hope this helps!