Practical Guide to Angular 6 Security – Add Authentication / Authorization (from scratch) to an Angular 6 / Node App
What you’ll learn
- Code in Github repository with downloadable ZIP files per section
- Get a solid foundation in Web Security Fundamentals
- Perform the attacks yourself manually, in order to fully understand them
- Understand and Defend an Application against common security attacks, such as Dictionary Attacks, Cross-Site Request Forgery, etc.
- Understand JWT in-depth, including the multiple signature types
- Design and Implement Application Authentication and Authorization from scratch
- Know how to add Authentication to an Angular Application using JWTs (and traditional Server Sessions)
- Know how to add RBAC (Role based Access control) Authorization to an Angular application
- Just some previous knowledge of Angular and Typescript
The course is an Web Application Security Fundamentals Course, where the application will use the Angular/Node stack.
This course covers Angular 6 and all the server code is in Typescript, but the security concepts explained in it are applicable to other technology stacks.
This course uses the Typescript language, and includes an auxiliary Ebook – The Typescript Jumpstart Ebook
We will use several MIT licensed Angular and Node packages from Auth0 (that you could use in your application), and we will also include a demo of how to use Auth0 for doing Application User Management.
Its important to realize that this is NOT an Auth0 specific course. Auth0 will be the source of a couple of open source packages we will use, and will be doing a quick demo of it to show how JWT makes it simple to delegate authentication to a third-party system, which could be developed in-house as well.
Security – A Fundamental Step in a Software Development Career
Security is probably the number one advanced topic that Software Developers are expected to master when going forward in their software development careers.
Learning Web Security Fundamentals, knowing how to design an application for security, and knowing how to recognize and fix security issues is an essential skill for a senior developer.
But the problem is that security knowledge is orthogonal to most other topics and it typically takes years to learn.
The good news is that once you have it, Security knowledge has a much longer shelf live than most software development knowledge in general.
Security is seen as something really hard to master – this is actually not the case! Application Security is much more approachable than you might think, depending on how you learn it.
What Is The Best Way To Learn Security in a Fun and Practical Way?
Here is what we will do: we are going to take the skeleton of a running application that has no security yet, and we are going to secure the application step-by-step.
Using a couple of MIT packages from Auth0 (that you would be able to use in any project), we are going to implement the Sign-Up and Login functionality from scratch, and because security cannot be enforced only at the client-side, we will implement both the frontend in Angular and the backend in Node.
As we secure the application, and we are going to periodically attack the application many times during the course, to prove that the vulnerabilities are real!!
We will also learn how to design our application for security, and we will learn how in many situations application design is ou best defense.
We will start at the beginning: we will see the proper way of doing User Management and Sign Up: we will learn how to store passwords in a database, and we will introduce cryptographic hashes in an approachable way.
Once we have the Sign-Up functionality in place, we will implement Login and understand the need for a temporary identity token. Our first implementation will be stateful login, where the token is kept at the server level.
We will use a couple of Auth0 packages to quickly refactor our Login to be JWT based, and learn the advantages of using JWT, and some potential disadvantages as well.
This means that if you can’t use Auth0 at your company, you can apply the same design principles and design a JWT-solution that delegates authentication to a centralized server behind the firewall.
We will also talk about server-side Authorization, and we will implement a commonly needed security-related Admin Level functionality: The Login As User service, that allows an admin to login as any user, to investigate a problem report. We can see why we would need to secure this functionality!
At the end of all these vulnerabilities and security fixes, we will have a well secured application and we will have learned a ton of security-related concepts along the way in a fun and practical way!
What Will you Learn In this Course?
With this course, you will have a rock-solid foundation on Web Application Security Fundamentals, and you will have gained the practical experience of applying those concepts by defending an application from a series of security attacks. You will have done so by actually performing many of the attacks!
Will have learned these concepts in the context of an Angular/Node application, but these concepts are applicable to any other technology stack.
You will learn what built-in mechanisms does Angular provide to defend against security problems, and what vulnerabilities it does NOT defend against and why.
Will know how to implement UI-level authorization and use client-side constructs like Router guards to implement it and even build your own authorization-related UI directives.
You will also learn about server side authorization, and how to implement a commonly needed backend service that is only accessible to Admins – Login As User.
What Will You Be Able to do at the End Of This Course?
This course could help you take your development career to a more senior level, where the knowledge about web application security is essential and a key differentiating factor.
If you are a private internet business owner or thinking of launching your own platform, this course will contain most of what you need in practice to secure your own online platform in a robust and effective way.
You will be able to understand most application-level vulnerability reports that come out of security audits done by third party companies, and you will be able to understand and fix the most commonly reported problems.Who this course is for:
- Angular Developers looking to learn in-depth Web Application Security in the specific context of an Angular Application
Size: 1.34 GB