angular-authentication

Rule reference

NGAUTH-001 — Tokens in localStorage/sessionStorage instead of httpOnly cookies

localStorage and sessionStorage are readable by any script running in the page — one XSS gap anywhere in the app (or in a third-party script, see angular-third-party-scripts) is enough to exfiltrate every stored token. An httpOnly cookie set by the .NET backend is invisible to JavaScript entirely; the token never touches app code.

BAD — token stored and read from localStorage

// auth.service.ts
login(credentials: LoginRequest) {
  return this.http.post<TokenResponse>('/api/auth/login', credentials).pipe(
    tap(res => {
      localStorage.setItem('access_token', res.accessToken); // readable by any injected script
      localStorage.setItem('refresh_token', res.refreshToken);
    })
  );
}

getToken(): string | null {
  return localStorage.getItem('access_token');
}

GOOD — backend sets an httpOnly, Secure, SameSite cookie; Angular never sees the token

// .NET backend — Program.cs / AuthController
Response.Cookies.Append("access_token", accessToken, new CookieOptions
{
    HttpOnly = true,
    Secure = true,
    SameSite = SameSiteMode.Strict,
    Expires = DateTimeOffset.UtcNow.AddMinutes(15)
});

// auth.service.ts — Angular sends credentials, cookie is set/read by the browser automatically
login(credentials: LoginRequest) {
  return this.http.post<void>('/api/auth/login', credentials, { withCredentials: true });
  // No token is ever stored or read in JS — the cookie rides along on every request.
}