Skip to content
This repository was archived by the owner on Jan 22, 2019. It is now read-only.

Commit 9a28a84

Browse files
committed
Added support for alternative token storage strategies
1 parent e1a75b4 commit 9a28a84

File tree

3 files changed

+61
-23
lines changed

3 files changed

+61
-23
lines changed

README.md

Lines changed: 31 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,12 @@
22

33
This is an Angular directive and HTTP interceptor available as a Bower package for adding OAuth 2 authentication support to AngularJS. In addition to this documentation a couple of samples and tutorials are available:
44

5-
[Authenticating AngularJS Against OAuth 2.0 / OpenID Using Google Connect](http://www.azurefromthetrenches.com/authenticating-angularjs-against-oauth-2-0-openid-connect/)
6-
7-
[Using AngularJS-OAuth2 with an instance of IdentityServer3](https://github.com/JamesRandall/AngularJS-OAuth2-IdentityServer3-Sample)
5+
[Authenticating AngularJS Against OAuth 2.0 / OpenID Connect](http://www.azurefromthetrenches.com/authenticating-angularjs-against-oauth-2-0-openid-connect/)
6+
[Sample of IdentityServer3 and AngularJS-OAuth2](https://github.com/JamesRandall/AngularJS-OAuth2-IdentityServer3-Sample)
87

98
The package is versioned using the [semantic versioning policy](http://semver.org).
109

11-
Feedback is very welcome. Please leave it in the [issues](https://github.com/JamesRandall/AngularJS-OAuth2/issues) area or over on my [blog](https://www.azurefromthetrenches.com).
10+
Feedback is very welcome. Please leave it in the [Issues](https://github.com/JamesRandall/AngularJS-OAuth2/issues) area or over on my [blog](https://www.azurefromthetrenches.com).
1211

1312
## Installing the Package
1413

@@ -66,9 +65,37 @@ sign-out-url |*(Optional)* The identity servers sign out endpoint. I
6665
silent-token-redirect-url|*(Optional)* If specified this will enable silent token renewal and the identity server will redirect to this URL. See section below for further details.
6766
state |*(Optional)* The value to use for CSRF protection. If not specified then a value will be autogenerated.
6867
template |*(Optional)* The Angular template to use for the sign in and out buttons.
68+
token-storage-handler |*(Optional)* Allows a custom token storage strategy to be used. See Token Storage below.
6969

7070
## Token Storage / State Management
7171

72+
By default the directive stores tokens in the browsers session storage however this behaviour can be changed by passing an object into the token-storage-handler attribute that supports the following methods:
73+
74+
**Method** |**Description**
75+
------------------|---------------
76+
clear($window) |Clears the token from storage
77+
get($window) |Retrieves the token from storage, should return the token as a serialized string
78+
set(token,$window)|Is passed a token as a serializes string and should store it
79+
80+
An example Angular controller implementing memory based token storage is shown below:
81+
82+
angular.module('uiApp').controller('IndexCtrl', function ($scope) {
83+
var memoryToken;
84+
$scope.memoryTokenHandler = {
85+
get: function() { return memoryToken; },
86+
set: function($window, token) { memoryToken = token; },
87+
clear: function() { memoryToken = undefined; }
88+
};
89+
});
90+
91+
As a contrast the default session storage handler (with full method parameters) is shown below:
92+
93+
var tokenStorage = {
94+
get: function($window) { return $window.sessionStorage.getItem('token') },
95+
set: function(token, $window) { $window.sessionStorage.setItem('token', token); },
96+
clear: function($window) { $window.sessionStorage.removeItem('token'); }
97+
};
98+
7299
Data that is required over page refreshes is stored within [session storage](https://developer.mozilla.org/en/docs/Web/API/Window/sessionStorage):
73100

74101
**Data** |**Description**

bower.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "AngularJS-OAuth2",
3-
"version": "1.1.0",
3+
"version": "1.2.0",
44
"homepage": "https://github.com/JamesRandall/AngularJS-OAuth2",
55
"authors": [
66
"James Randall"

dist/angularJsOAuth2.js

Lines changed: 29 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
'use strict';
22

33
(function() {
4+
var tokenStorage = {
5+
get: function($window) { return $window.sessionStorage.getItem('token') },
6+
set: function(token, $window) { $window.sessionStorage.setItem('token', token); },
7+
clear: function($window) { $window.sessionStorage.removeItem('token'); }
8+
};
9+
410
function expired(token) {
511
return (token && token.expires_at && new Date(token.expires_at) < new Date());
612
};
713
function getSessionToken($window) {
8-
var tokenString = $window.sessionStorage.getItem('token');
14+
var tokenString = tokenStorage.get($window);
915
var token = null;
1016
if (tokenString && tokenString !== "null" ) {
1117
token = JSON.parse(tokenString);
@@ -32,7 +38,7 @@
3238
var token = getTokenFromHashParams(hash);
3339
if (token !== null) {
3440
setExpiresAt(token);
35-
$window.sessionStorage.setItem('token', JSON.stringify(token));
41+
tokenStorage.set(JSON.stringify(token), $window)
3642
}
3743
return token;
3844
}
@@ -126,6 +132,7 @@
126132
return service.token;
127133
};
128134
service.destroy = function() {
135+
tokenStorage.clear($window)
129136
$window.sessionStorage.setItem('token', null);
130137
service.token = null;
131138
};
@@ -308,22 +315,23 @@
308315
restrict: 'E',
309316
replace: true,
310317
scope: {
311-
authorizationUrl: '@', // authorization server url
312-
clientId: '@', // client ID
313-
redirectUrl: '@', // uri th auth server should redirect to (cannot contain #)
314-
responseType: '@', // defaults to token
315-
scope: '@', // scopes required (not the Angular scope - the auth server scopes)
316-
state: '@', // state to use for CSRF protection
317-
template: '@', // path to a replace template for the button, defaults to the one supplied by bower
318-
buttonClass: '@', // the class to use for the sign in / out button - defaults to btn btn-primary
319-
signInText: '@', // text for the sign in button
320-
signOutText: '@', // text for the sign out button
321-
signOutUrl: '@', // url on the authorization server for logging out. Local token is deleted even if no URL is given but that will leave user logged in against STS
322-
signOutAppendToken: '@', // defaults to 'false', set to 'true' to append the token to the sign out url
323-
signOutRedirectUrl: '@', // url to redirect to after sign out on the STS has completed
324-
silentTokenRedirectUrl: '@', // url to use for silently renewing access tokens, default behaviour is not to do
325-
nonce: '@?', // nonce value, optional. If unspecified or an empty string and autoGenerateNonce is true then a nonce will be auto-generated
326-
autoGenerateNonce: '=?' // Should a nonce be autogenerated if not supplied. Optional and defaults to true.
318+
authorizationUrl: '@', // authorization server url
319+
clientId: '@', // client ID
320+
redirectUrl: '@', // uri th auth server should redirect to (cannot contain #)
321+
responseType: '@', // defaults to token
322+
scope: '@', // scopes required (not the Angular scope - the auth server scopes)
323+
state: '@', // state to use for CSRF protection
324+
template: '@', // path to a replace template for the button, defaults to the one supplied by bower
325+
buttonClass: '@', // the class to use for the sign in / out button - defaults to btn btn-primary
326+
signInText: '@', // text for the sign in button
327+
signOutText: '@', // text for the sign out button
328+
signOutUrl: '@', // url on the authorization server for logging out. Local token is deleted even if no URL is given but that will leave user logged in against STS
329+
signOutAppendToken: '@', // defaults to 'false', set to 'true' to append the token to the sign out url
330+
signOutRedirectUrl: '@', // url to redirect to after sign out on the STS has completed
331+
silentTokenRedirectUrl: '@', // url to use for silently renewing access tokens, default behaviour is not to do
332+
nonce: '@?', // nonce value, optional. If unspecified or an empty string and autoGenerateNonce is true then a nonce will be auto-generated
333+
autoGenerateNonce: '=?', // Should a nonce be autogenerated if not supplied. Optional and defaults to true.
334+
tokenStorageHandler: '='
327335
}
328336
};
329337

@@ -353,6 +361,9 @@
353361

354362

355363
function init() {
364+
if (scope.tokenStorageHandler) {
365+
tokenStorage = scope.tokenStorageHandler
366+
}
356367
scope.buttonClass = scope.buttonClass || 'btn btn-primary';
357368
scope.signInText = scope.signInText || 'Sign In';
358369
scope.signOutText = scope.signOutText || 'Sign Out';

0 commit comments

Comments
 (0)