How to keep the REST authentication credentials in AngularJS on page reload?
angularjs, basic-authentication, http, rest
Solution
Hmm, this is a tricky one. One possible solution is to use some combination of e.g. Javascrypt (http://www.fourmilab.ch/javascrypt/) and temporary localstorage/cookie.
Do not store the password at all, not even in localstorage. You can use a key derivation function to get a key from the password. With a salt and a reasonable number of iterations this could be secure enough.
Update:
See this securely store user password locally in a jquery mobile app for another good answer
Problem
We built a RESTful server, quite 'pure', which uses HTTP BASIC AUTHENTICATION. This means the client needs to send username/password every request. It is simple and secure (over HTTPS). REST of course is stateless and uses no sessions, so there is no 'logon' method in the API. Every request needs to be authorized again. On this REST server we built an AngularJS client. This is a single page application. When the user logs in to the client, the client will store the credentials and make sure the correct HTTP headers are set. The “problem” is that when the user refreshes the browser, the app looses its state, including the authentication credentials. What is the best way to deal with this? How can the AngularJS app keep the user logged in / remember the credentials? Whatever the solution, it MUST be secure, since it is a banking application.