I am fairly new to Angular, JWT, oAuth, and CORS.
For various reasons, our hope is to separate our teams into 2 distinct roles (based on geographic location). We have 1 team focused on the service layer (Spring layer with RESTful API), while another team will focus on UI-only (possibly deployed from a separate server for a few other reasons).
I know cross domain communication is possible with CORS, so the UI should be able to communicate to a server that didn't host it... but I'm trying to figure out if we can launch a UI-only Angular application and pass in a JWT token at launch. All examples online have the UI sending a request with a user/pass in order to receive a token. Essentially, we want to have the Service team handle all the IdP/token/etc work, while the UI focuses on just the UI.
Very High Level Concept:
- The Server side uses a basic .jsp page to redirect the user to our authentication service(s), then authenticate the user.
- Once the user is authenticated, the service layer team would launch our separate User Interface (written using Angular) and pass the UI a token to establish the trust relationship.
My Question involves the high level workflow in which this could (should) occur. I assume I have 2 options, but not sure which would be recommended.
- Can/should an Angular application be launched ("UI-only") with a token passed in? Essentially, receive a token as a request parameter?
- Can/should an Angular application first launch, then make an immediate request for a token (maybe in an Angular lifecycle event)?