[Question] http request against authorized api:s and server pre-rendering #249

Activity

1. SteveSandersonMS commented on Aug 15, 2016

   

   SteveSandersonMS

   on Aug 15, 2016

   Member

   More actions

   The intended way to pass through whatever auth tokens you need into your server-side JavaScript is via the aspnet-prerender-data parameter (see the docs under the heading Passing data from .NET code into JavaScript code here).

   We have considered trying to do some kind of automatic transparent pass-through of cookie data, so that any calls to Node's http get/post APIs automatically have attached whatever cookies originally came into the ASP.NET application. But from a security point of view that's very dangerous - we'd have to reimplement the browser's same-origin policy logic completely and perfectly, plus all the CORS logic that runs in browsers, otherwise you might unexpectedly leak auth credentials to third party API endpoints. We're not realistically going to do that, plus even if we did, it would only account for cookie-based auth, and not any other kind of authentication that's common in SPAs (such as just holding tokens in memory and including them in fetch calls).

   So to answer your questions directly:

   1: Is there any way of making the prerendering functionality take identity authorization into consideration

   Yes, get whatever auth tokens you want in your .NET code, and then pass them through into your boot-server.ts logic via the aspnet-prerender-data API. See the docs linked above for exact details. Then your Node-side code can include it in any API calls you make.

   2: is there preferred way (other than buildning control mechanism yourself) which can be used to only run certain ng2 calls / methods if rendered on client-side?

   Yes, you can have logic like this:

   if (typeof window === 'undefined') {
       // code that runs only on the server
   } else {
       // code that runs only on the client
   }
   

   If you have any proposals for how we could make this better then please let us know!

   👍React with 👍1Reacted by Base
2. SteveSandersonMS

   closed this as completedon Aug 15, 2016
3. MarkPieszak commented on Aug 15, 2016

   

   MarkPieszak

   on Aug 15, 2016

   Contributor

   More actions

   You can also import isBrowser or isServer from Universal to test whether it's browser / server as well. Just throwing that out there!

   👍React with 👍1Reacted by Base
4. SteveSandersonMS commented on Aug 15, 2016

   

   SteveSandersonMS

   on Aug 15, 2016

   Member

   More actions

   @MarkPieszak Cool, I didn't know about those. Thanks for the info!
5. baserz commented on Aug 16, 2016

   

   baserz

   on Aug 16, 2016

   Last edited by baserz

   Author

   More actions

   Thanks guys! Suspected something like isBrowser, isServer, just didnt find it. If i have any useful input / suggestions ill post it :).
6. bradchristensen commented on Aug 21, 2016

   

   bradchristensen

   on Aug 21, 2016

   Contributor

   More actions

   We have considered trying to do some kind of automatic transparent pass-through of cookie data, so that any calls to Node's http get/post APIs automatically have attached whatever cookies originally came into the ASP.NET application.

   We went through this same thought process for our own APIs and ended up implementing an isomorphic HTTP request library that uses cookies that were passed in from the C# process when on the server side, but we have to be careful to only pass through cookies for internal requests. As @SteveSandersonMS said this would be either very difficult or very dangerous to implement in a generic way. 😄