3 ms·
The convention is usually to serve the SPA via a CDN regardless of server side authentication and then have client-side routing prohibit users from rendering au
by ben_jones 10y ago
The convention is usually to serve the SPA via a CDN regardless of server side authentication and then have client-side routing prohibit users from rendering authenticated pages. This assumes data is authenticated/authorized within a server side api and no privileged information is in client-side code (it never should).
In angular this is usually achieved by watching for state/route change events and deducing whether or not a route should be redirected or allowed to progress based on the status of the currentUser.
It sounds a little hairy but in my experience there are ample resources detailing the process and realistically it's about ~30 LOC.