AngularJS- Login and Authentication in each route and controller

My solution breaks down in 3 parts: the state of the user is stored in a service, in the run method you watch when the route changes and you check if the user is allowed to access the requested page, in your main controller you watch if the state of the user change.

app.run(['$rootScope', '$location', 'Auth', function ($rootScope, $location, Auth) {    $rootScope.$on('$routeChangeStart', function (event) {        if (!Auth.isLoggedIn()) {            console.log('DENY');            event.preventDefault();            $location.path('/login');        }        else {            console.log('ALLOW');            $location.path('/home');        }    });}]);

You should create a service (I will name it Auth) which will handle the user object and have a method to know if the user is logged or not.

service:

 .factory('Auth', function(){var user;return{    setUser : function(aUser){        user = aUser;    },    isLoggedIn : function(){        return(user)? user : false;    }  }})

From your app.run, you should listen the $routeChangeStart event. When the route will change, it will check if the user is logged (the isLoggedIn method should handle it). It won't load the requested route if the user is not logged and it will redirect the user to the right page (in your case login).

The loginController should be used in your login page to handle login. It should just interract with the Auth service and set the user as logged or not.

loginController:

.controller('loginCtrl', [ '$scope', 'Auth', function ($scope, Auth) {  //submit  $scope.login = function () {    // Ask to the server, do your job and THEN set the user    Auth.setUser(user); //Update the state of the user in the app  };}])

From your main controller, you could listen if the user state change and react with a redirection.

.controller('mainCtrl', ['$scope', 'Auth', '$location', function ($scope, Auth, $location) {  $scope.$watch(Auth.isLoggedIn, function (value, oldValue) {    if(!value && oldValue) {      console.log("Disconnect");      $location.path('/login');    }    if(value) {      console.log("Connect");      //Do something when the user is connected    }  }, true);

Here is another possible solution, using the resolve attribute of the $stateProvider or the $routeProvider. Example with $stateProvider:

.config(["$stateProvider", function ($stateProvider) {  $stateProvider  .state("forbidden", {    /* ... */  })  .state("signIn", {    /* ... */    resolve: {      access: ["Access", function (Access) { return Access.isAnonymous(); }],    }  })  .state("home", {    /* ... */    resolve: {      access: ["Access", function (Access) { return Access.isAuthenticated(); }],    }  })  .state("admin", {    /* ... */    resolve: {      access: ["Access", function (Access) { return Access.hasRole("ROLE_ADMIN"); }],    }  });}])

Access resolves or rejects a promise depending on the current user rights:

.factory("Access", ["$q", "UserProfile", function ($q, UserProfile) {  var Access = {    OK: 200,    // "we don't know who you are, so we can't say if you're authorized to access    // this resource or not yet, please sign in first"    UNAUTHORIZED: 401,    // "we know who you are, and your profile does not allow you to access this resource"    FORBIDDEN: 403,    hasRole: function (role) {      return UserProfile.then(function (userProfile) {        if (userProfile.$hasRole(role)) {          return Access.OK;        } else if (userProfile.$isAnonymous()) {          return $q.reject(Access.UNAUTHORIZED);        } else {          return $q.reject(Access.FORBIDDEN);        }      });    },    hasAnyRole: function (roles) {      return UserProfile.then(function (userProfile) {        if (userProfile.$hasAnyRole(roles)) {          return Access.OK;        } else if (userProfile.$isAnonymous()) {          return $q.reject(Access.UNAUTHORIZED);        } else {          return $q.reject(Access.FORBIDDEN);        }      });    },    isAnonymous: function () {      return UserProfile.then(function (userProfile) {        if (userProfile.$isAnonymous()) {          return Access.OK;        } else {          return $q.reject(Access.FORBIDDEN);        }      });    },    isAuthenticated: function () {      return UserProfile.then(function (userProfile) {        if (userProfile.$isAuthenticated()) {          return Access.OK;        } else {          return $q.reject(Access.UNAUTHORIZED);        }      });    }  };  return Access;}])

UserProfile copies the current user properties, and implement the $hasRole, $hasAnyRole, $isAnonymous and $isAuthenticated methods logic (plus a $refresh method, explained later):

.factory("UserProfile", ["Auth", function (Auth) {  var userProfile = {};  var clearUserProfile = function () {    for (var prop in userProfile) {      if (userProfile.hasOwnProperty(prop)) {        delete userProfile[prop];      }    }  };  var fetchUserProfile = function () {    return Auth.getProfile().then(function (response) {      clearUserProfile();      return angular.extend(userProfile, response.data, {        $refresh: fetchUserProfile,        $hasRole: function (role) {          return userProfile.roles.indexOf(role) >= 0;        },        $hasAnyRole: function (roles) {          return !!userProfile.roles.filter(function (role) {            return roles.indexOf(role) >= 0;          }).length;        },        $isAnonymous: function () {          return userProfile.anonymous;        },        $isAuthenticated: function () {          return !userProfile.anonymous;        }      });    });  };  return fetchUserProfile();}])

Auth is in charge of requesting the server, to know the user profile (linked to an access token attached to the request for example):

.service("Auth", ["$http", function ($http) {  this.getProfile = function () {    return $http.get("api/auth");  };}])

The server is expected to return such a JSON object when requesting GET api/auth:

{  "name": "John Doe", // plus any other user information  "roles": ["ROLE_ADMIN", "ROLE_USER"], // or any other role (or no role at all, i.e. an empty array)  "anonymous": false // or true}

Finally, when Access rejects a promise, if using ui.router, the $stateChangeError event will be fired:

.run(["$rootScope", "Access", "$state", "$log", function ($rootScope, Access, $state, $log) {  $rootScope.$on("$stateChangeError", function (event, toState, toParams, fromState, fromParams, error) {    switch (error) {    case Access.UNAUTHORIZED:      $state.go("signIn");      break;    case Access.FORBIDDEN:      $state.go("forbidden");      break;    default:      $log.warn("$stateChangeError event catched");      break;    }  });}])

If using ngRoute, the $routeChangeError event will be fired:

.run(["$rootScope", "Access", "$location", "$log", function ($rootScope, Access, $location, $log) {  $rootScope.$on("$routeChangeError", function (event, current, previous, rejection) {    switch (rejection) {    case Access.UNAUTHORIZED:      $location.path("/signin");      break;    case Access.FORBIDDEN:      $location.path("/forbidden");      break;    default:      $log.warn("$stateChangeError event catched");      break;    }  });}])

The user profile can also be accessed in the controllers:

.state("home", {  /* ... */  controller: "HomeController",  resolve: {    userProfile: "UserProfile"  }})

UserProfile then contains the properties returned by the server when requesting GET api/auth:

.controller("HomeController", ["$scope", "userProfile", function ($scope, userProfile) {  $scope.title = "Hello " + userProfile.name; // "Hello John Doe" in the example}])

UserProfile needs to be refreshed when a user signs in or out, so that Access can handle the routes with the new user profile. You can either reload the whole page, or call UserProfile.$refresh(). Example when signing in:

.service("Auth", ["$http", function ($http) {  /* ... */  this.signIn = function (credentials) {    return $http.post("api/auth", credentials).then(function (response) {      // authentication succeeded, store the response access token somewhere (if any)    });  };}])

.state("signIn", {  /* ... */  controller: "SignInController",  resolve: {    /* ... */    userProfile: "UserProfile"  }})

.controller("SignInController", ["$scope", "$state", "Auth", "userProfile", function ($scope, $state, Auth, userProfile) {  $scope.signIn = function () {    Auth.signIn($scope.credentials).then(function () {      // user successfully authenticated, refresh UserProfile      return userProfile.$refresh();    }).then(function () {      // UserProfile is refreshed, redirect user somewhere      $state.go("home");    });  };}])

The most straightforward manner of defining custom behavior for individual routes would be pretty easy:

1) routes.js: create a new property (like requireAuth) for any desired route

angular.module('yourApp').config(function($routeProvider) {    $routeProvider        .when('/home', {            templateUrl: 'templates/home.html',            requireAuth: true // our custom property        })        .when('/login', {            templateUrl: 'templates/login.html',        })        .otherwise({            redirectTo: '/home'        });})

2) In a top-tier controller that isn't bound to an element inside the ng-view (to avoid conflict with angular $routeProvider ), check if the newUrl has the requireAuth property and act accordingly

 angular.module('YourApp').controller('YourController', function ($scope, $location, session) {          // intercept the route change event     $scope.$on('$routeChangeStart', function (angularEvent, newUrl) {                  // check if the custom property exist         if (newUrl.requireAuth && !session.user) {                          // user isn’t authenticated             $location.path("/login");         }     }); });