I'm working on a hybrid app that is based on Angular 1.5. In part of the app now, the client wants a messaging system for the admin of a group to be able to message the normal worker/user. I want to check and see if this is done, would server sent events be the solution? If so, do I continue to let it run as the user has the app open? How does this affect performance?
I am presuming authentication would need to be performed against users in order to differentiate between admin and worker accounts.
Have Angular send AJAX calls to your server, which will check the users' authentication status before the client-side view is rendered.
You should research the resolve property in Angular in order to implement this type of solution.
Related
For learning purposes I’m creating an Android app that does the following:
When a person arrives at school, he/she can check a button in the app and he/she is added in real-time to a list (in the server database) of everyone that also checked “at school” button within the app. He/she can also add a message before clicking the button.
The rest of the students then receive a toast in real-time with the person’s name that arrived and it’s message.
I know how to do the Android part, but what is the best way to do the real-time event queries and requests in communication with the server? For example, I send a socket with the persons confirmation, location and message to the server. From the server-side, I supose there’s a nodejs controller that receives the socket and updates the database in sql. Then it sends a socket to every client online and a confirmation to the checked client.
Is this the “professional” way to handle data like this? What is the best (fastest, more secure, standard) way? When I Google how to make this communication I can only find web server client-server communication with Apache, but I’m really looking for a real-time event with an Android app.
I’m not really looking for code but to know and understand technologies and design patterns on how this can be done. And what to search for in order to learn how to do this.
I am using Meteor 1.10 + mongodb.
I have multiple mobile chat & information applications.
These mobile application are natively developed using Meteor DDP libraries.
But I have same users base for all the apps.
Now I want to create a separate meteor instance on separate individual server to keep the users base centralized.
I need suggestions that how can I acheive this architecture with meteor.
Keeping reactivity and performance in mind.
For a centralized user-base with full reactive functionality you need an Authorization Server which will be used by your apps (= Resource Servers) in order to allow an authenticated/authorized request. This is basically the OAuth2 3-tier workflow.
See:
https://www.rfc-editor.org/rfc/rfc6749
https://www.oauth.com/
Login Service
You will also have to write your own login handler (Meteor.loginWithMyCustomAuthServer) in order to avoid DDP.connect because you would then have to manage two userbases (one for the app itself and one for the Authorization Server) and this will get really messy.
This login handler is then retrieving the user account data after the Oauth2 authorization request has been successful, which will make the Authorization Server's userbase the single point of truth for any of your app that is registered (read on Oauth2 workflow about clientId and secret).
Subcribing to users
The Auth server is the single point of truth where you create, updat or delete your users there and on a successfull login your local app will always get the latest user data synced from this accounts Auth Server (this is how Meteor does it with loginWith<Service> too)
You then subscribe to your users to the app itself without any ddp remote connection. This of course works only if the user data you want to get is actually for online users.
If you want to subscribe for any user (where the data might have not been synced yet) you still need a remote subscription to a publication on the Authorizazion server.
Note, that in order to authenticate users with this remote subscription you need an authenticated DDP request (which is also backed by the packages below).
Implementation
Warning - the following is an implementation by myself. This is due to I have faced the same issue and found no other implementation before mine.
There is a full working Accounts server (but constantly work in progress)
https://github.com/leaonline/leaonline-accounts
it uses an Oauth2 nodejs implementation, which has been wrapped inside a Meteor package:
https://github.com/leaonline/oauth2-server
and the respective login handler has also been created:
https://github.com/leaonline/meteor-accounts-lea
So finally I got a work around. It might not be the perfect way to handle this, but to my knowledge it worked for me so well. But yes I still open for suggestions.
Currently I have 4 connecting applications which are dependent on same users base.
So I decided to build SSO (Centralized Server for managing Users Database)
All 4 connecting applications ping SSO for User-Authentication and getting users related data.
Now those 4 connecting applications are developed using Meteor.
Main challenge here was to make things Reactive/Realtime.
E.g Chat/Messaging, Group Creations, Showing users list & listeners for newly registered users.
So in this scenario users database was on other remote server (SSO), so on connecting application I couldn't just:
Meteor.publish("getUsers")
So on connecting applications I decided to create a Temporary Collection called:
UserReactiveCollection
With following structure:
UserReactiveCollection.{
_id: 1,
userId: '2',
createdAt: new Date()
}
And I published subscription:
Meteor.publish("subscribeNewUserSso", function () {
return UserReactiveCollection.find({});
});
So for updating UserReactiveCollection I exposed Rest Api's on each connecting application respectively.
Those apis receive data from SSO and updates in UserReactiveCollection.
So on SSO side when ever a new user is registered. I ping those Apis (on connecting applications) and send the inserted userId in the payload.
So now those connecting applications receives onDataChanged ping from the subscription and gets userId.
Using that userId the connecting applications pings back to SSO and get user details of that specific userId and prepends to the users list.
Thats how I got it all working so for now I am just marking my answer accepted but as I mentioned above that: "It might not be the perfect way to handle this, but to my knowledge it worked for me so well. But yes I still open for suggestions."
And special thanks to #Jankapunkt for helping me out.
When a user authenticates on my app (by Google plus) I want to create a row in a Users table by the server side. I would not know how to do.
I think there is a function that is called when a users is authenticated.
My app is a mobile app with JavaScript back-end (Node.js).
I don't know of a callback that happens on successful authentication, but an easier way to implement this would be to require authentication on all of your endpoints, and then add the user information to a table if it doesn't already exist.
See this article for information on how to get user details in your Node.js app: How to: Require Authentication for access to tables.
Server: NGINX/PHP running Laravel 5
Let's assume I have two users on different computers with sessions to the application.
User 1: makes an ajax call that is handled by one of the server controllers.
User 2: needs to get notified of this as soon as user 1 made this call to the controller.
Now, user 2 can have a javascript polling mechanism which asks the question "has this happened?" repeatedly, but ideally I'd like to avoid the constant calling and have him/her notified upon occurance instead.
Is there any way to have like an "open socket" for user 2 to be notified when certain events occur in the controller?
Ideally I'd like to avoid installing a third party messaging system, XMPP Etc on my server. Is there any best practice where this functionality can be achieved?
Sockets.io is indeed a good solution for this. I'll be using it on both the server side (Separate NodeJS server for this), and the client javascript side.
As ionic uses angularjs, for login system there isn't any browser to save cookie or session in order to authenticate for each part of application.
One way is protecting by using this in app.js:
$urlRouterProvider.otherwise('/login');
Because any one doesn't access to other links into application. When returned answer from server (mysql database) is true , we can use this:
$state.go('app.main');
Is this a good idea? Or any other ways?
Since ionic essentially calls to a back end api, you can implement any standard api authentication mechanism.
The most common was would be have a toke based authentication, High level workflow can be as follows
1 - ionic app calls a backend server end point and get a token (by passing some kind of an encrypted key)
2 - Back end server generates a token (ideal for a given time period) and sends back to the ionic app.
3 - There after, in every request ionic sends the token. (ideally in the request header)
To save the token temporary , you can use a simple storage solutions like
ng-storage or sqlite
have a read here
For our company app we use a digest access authentication(https://en.wikipedia.org/wiki/Digest_access_authentication) with our ionic app and our node server that is hooked up to a sql database. Once the user is authenticated we send them a jwt (javascript web token). We can then store that webtoken locally (if they check the option for auto login) or they can re-authenticate whenever the app is reopened and we give them another web token. This has so far proven to be a safe and efficient method of user authentication. Here is a tutorial for using json web tokens and angular. http://www.toptal.com/web/cookie-free-authentication-with-json-web-tokens-an-example-in-laravel-and-angularjs
I would strongly encourage you to checkout John Papa's ng-demoes, especially one with JWT token, because that is what you want to use nowadays. (Those are not specific to ionic, but rather for angular.js apps in general)
basically you have several things you need to do:
handle all the places where you need to check if user is authenticated or not and emit unauthorized event
handle event and redirect to login state/route
In above example you basically add interceptor (https://github.com/johnpapa/ng-demos/blob/master/ng-jwt/src/client/app/services/authInterceptor.js) which looks if any request to the web services failed due to not authorized and rejects the promise returned by $http request
Also
As ionic uses angularjs, for login system there isn't any browser to save cookie or session in order to authenticate for each part of application.
You indeed can use localStorage/sessionStorage to store token and add that token to all requests. That is why you better off having token based auth for your web services, rather than cookie based. (basic auth can do to, just more cumbersome)