How should I make sure the user accessing a backend rendered frontend route is authenticated?

Question

I'm using Laravel and Angular to write a web app.

In the front end Laravel is used to create the basic template, but otherwise controlled by Angular. In the back end laravel is used to create a restful API.

I have a few routes like this:

Route::group(['domain' => 'domain.com'], function() {

    Route::get('/', ['as' => 'home', function () {
        return view('homepage');
    }]);

    Route::get('/login', ['as' => 'login', function () {
        return view('login');
    }]);

    //users should be authenticated before accessing this page
    Route::get('/dashboard', ['as' => 'dashboard', function () {
        return view('dashboard');
    }]); 

});

Route::group(['domain' => 'api.domain.com', 'middleware' => ['oauth']], function() {
    Route::post('/post/create', ['uses' => 'PostController@store']);
    Route::get('/post/{id}', ['uses' => 'PostController@show']);

     //other API endpoints
     // ...
});

I want to make sure my domain.com/dashboard URL is only accessed by authenticated users.

In my backend I have OAuth implemented for my API routes which makes sure the user accessing those routes are authentic. Laravel's Auth::once() is used by the OAuth library to make sure the user credentials are correct then generates an access_token. Since Auth::once() is a "stateless" function no session or cookies are utilized and I cannot use Auth::check() to make sure a user is authenticated before the dashboard page is rendered.

How should I go about checking to see if the user trying to access domain.com/dashboard is authenticated? Should I send the access_token in the header when I forward the user from /login to /dashboard? Or should I implement Laravel's a session/cookie based authentication?

---

EDIT: As per this: Adding http headers to window.location.href in Angular app I cannot forward the user to the dashboard page with an Authorization header.

In order to reuse my API for my mobile apps I STRONGLY prefer to use some sort of token based authentication.

Answer 1

I would advise to use JWT (JSON Web Tokens) to control for authentication.

I think there are several tutorials for their use with Lavarel and AngularJS. I'm more into Python and I use Flask, but the followings look interesting :

• Simple AngularJS Authentication with JWT : the AngularJS configuration
• Token-Based Authentication for AngularJS and Laravel Apps : the connection with Laravel
• JSON Web Token Tutorial: An Example in Laravel and AngularJS

Answer 2

Pierre was right in suggesting JWT for your token based auth.

When the user successfully logs in, before you finish the request, you can create a JWT and pass that back to the client. You can store it on the client (localStorage, sessionStorage) if you want. Then on subsequent requests, put the JWT inside of your Authorization header. You can then check for this header in your middleware and prevent access to your API routes if the token is valid. You can also use that token on the client and prevent Angular from switching routes if the token doesn't exists or isn't valid.

Now if you are trying to prevent the user from accessing the page entirely on initial load (Opens browser, goes straight to domain.com/dashboard), then I believe that is impossible since there is no way to get information about the client without first loading some code on the page.