Routing security flaw in Angular/MEAN.io?
Its just an app configuration. If you change the routes.js from:
app.get('/articles', articles.all);to
app.get('/articles', auth.requiresLogin, articles.all);Then if you try and hit the url /articles directly you get the message:
"User is not authorized"
Instead of JSON listing all the articles.
As you say, removing the #! causes the routing to be handled by the server. The node API then dumps the user object in the response.
The problem is completely independent from Angular - the app is only served by Node at the / route. Angular then uses the hash value to show the correct page.
This is probably just a problem with the example provided by MEAN. The app itself is insecure, when they talk about best practices that refers to the code structure and setup rather than the quick demo.
You could ask them about it, since there will probably be people who build on top of the example and don't fix the security issues.