How to store authorization token for HTTP call from Angular?

Question

I am trying to make an HTTP call to our legacy APIs. These APIs use basic authorization.

When making a call from an Angular app, I have to pass this authorization token which is not a problem. My concern is that anyone can sniff the token from the Angular app, and that would allow them to make calls to our APIs.

How can I call existing APIs without compromising the token?

You can't. If the client-side app needs a token, the user can access it. — jonrsharpe
– jonrsharpe, Commented Aug 21, 2020 at 9:35
is there another way of doing this? To make calls to api more secure? — Ali
– Ali, Commented Aug 21, 2020 at 9:36
One way to do it is create a server in between your client app and the API, it will take care of the security concern. Remember that frontend is public anything can leak from public cookies, local storage, session storage etc. — TZiebura
– TZiebura, Commented Aug 21, 2020 at 9:36
As @TZiebura says, you need a server to proxy those requests from your client to the legacy APIs and add the token. Then the token isn't available to the client (and you can also do validation etc. before sending client data to those APIs). — jonrsharpe
– jonrsharpe, Commented Aug 21, 2020 at 9:40

Numichi · Accepted Answer · 2020-08-21 09:49:16Z

-2

User can reach any storage on client side (example via console). So, you can not hide it.

So, You can just save this token and set to request with HttpInterceptor:

answered Aug 21, 2020 at 9:49

Numichi

1,1329 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to store authorization token for HTTP call from Angular?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related