4

A few questions came across my mind about how to secure a login page (Web).

When I build a demo app for instance a web-application with VueJS or just really blank using HTML/JS, I thought can a login page be ever secure? Or am I missing something.

For example: When I create the login page where a user can click on a login button I potentially send a request to my backend server and if it is successful an access-token is returned and then I route my frontend page to the next view or create some object, unnecessary.

Now to the question: Is there a way to present a new view if the login really worked? Because I can just look in the Javascript file change the response or either fill in my own response and the behaviour is displayed what should only be displayed when the login was successful.

Am I forced to PHP to do so, or is there the same result? Am I missing something? Thanks for your answers! I hope you understand what I mean.

4
  • The Server should only send Relevant Information back after he received a valid Authentication. This way even if you bypass your Login somehow it will be a blank page because the Server wont send any data out
    – niclas_4
    Nov 15, 2018 at 10:29
  • Okay you mean the server should send the html file. But what if Backend for authentication and Frontend are separate projects? Or is this the only way
    – Markus G.
    Nov 15, 2018 at 10:30
  • Irrelevant. The backend is sending the information post-authentication, and the backend is validating the authentication.
    – symcbean
    Nov 15, 2018 at 13:01
  • Which information will the backend send after authentication? Do you have an example? a JSON with success true would be the problem I described
    – Markus G.
    Nov 15, 2018 at 13:05

2 Answers 2

2

I am assuming we are in a typical single page app/web app context here, with separated front end and back end (api) projects, communicating via (asynchronouse) HTTP requests:

In this case: Yes it will be safe because your front end does not contain any protected data in the first place. It's the servers responsibility to only send data the client is allowed to have.

In this case, it doesn't matter what exactly the server responds to your login. It could be a JSON with success and a token or the current user object and a cookie. The important part is that your front end now knows a secret the server gave it. The frontend can now happily switch to another view (remember, a view does not come with any data initally) and request some protected data it wants to display with the received secret.

If you would have tricked the front end to think you are logged in, the request now would fail (because you never got a secret from the server) and you would sit there, starring at a blank UI and probably an error message.

To your last question, if you are forced to PHP (or so): No but yes. You will need something on your server side that knows about your users and their privileges, something that decides who is allowed to view or alter data, but that something does not have to be PHP. Common serverside languages for web applications would be Node.js, PHP and Python but you are by no means limited to them.

2
  • Is there a way to “protect” the Blank UI when the frontend is tricked? Except sending a whole html from the server?
    – Markus G.
    Nov 15, 2018 at 14:03
  • No. As soon as something is sent to your browser its accessible. If you really have to protect a UI you have to load it separately from the server as soon as you are logged in. Most front end frameworks support loading templates and components out of the box though.
    – Fitzi
    Nov 15, 2018 at 14:04
1

You could set a session variable for the current user if the login was succesfull. The session is server-side so it is much trickier to hijack the session key.

Further, you could set a time stamp and check when the user's last page refresh took place on each page load. If he did not refresh the page for X amount of time, you can unset the session variable and log out the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.