Security in Angular2 with TS

Question

I want to build a web application using Angular2 with TS.

I read several tutorials about authentication in Angular2 and they say, that I have to implement the following things.

1. index component (public)
2. login component (public)
3. my private component (private)

All this components are routed with the Angular-Router and protected with some guards.

But I think that this guards are not really secure. The routes are guarded but the components are there somewhere in js on the client. Some "js-hacker" could access the private component without permissions.

Am I right with this thought?

My solution would be to request the private component during the authentication request and returning it only if the user has permission.

But in this case, I had to split up my application in a login part and a private part. (Seems like overhead)

Another solution would be to send a token with every request, so that the "js-hacker" is able to see the component, but not its data therefore it's useless for him. (But this token needs to be stored)

Please help me to decide which way to go in terms of security, or suggest me a better one (I would prefer a better one...).

Thanks.

Answer 1

You'd use *ngIf to conditionally attach your secured component on a valid authentication status. If whatever you bind the *ngIf to evaluates as false, it won't just hide it from view, it will completely remove the component and everything inside it from the DOM.

If they knew what they were doing, they could still look at the source code for the component, yes, but as you surmised, you'd want to keep sensitive data out of the source code and only grab it from somewhere secure for authenticated users.

You should really look into Google's Firebase . Firebase can handle authentication for you much more securely and robustly than you could yourself and you can use Firebase Realtime Database to store sensitive data and only send it to the client when users are authenticated. It's incredibly simple, works very well with Angular ( AngularFire2 is the official library though it's not necessary), and it has a ton more features than just database and authentication. Trust me, you will not regret it.