Blocking routes for non-logged-in users

Question

I’m doing an application and now that it’s almost complete I was testing the attacks. I realized that with ngRoute routes the application is vulnerable to url entries.

For example, the application starts redirecting to the login page, but if I go to the url and type the name of a specific page, it enters without logging in. Thanks to the token, the user cannot make any interaction with the application, but still he has access to content that does not request the back.

My situation, I searched the internet and found something about an attribute in the called Angularjs resolves. I tried to implement it, but without success. The question, is there any way in Angularjs to block all routes for those who are not logged in? If yes, how?

Answer 1

I usually do like this, maybe I’ll be useful to you:

app.module.js file

angular.module('ModuloDaApp', ['LoginController', 'AdminController', 'UserController', 'ngRoute'])
    .run(preAtivador);

function preAtivador($rootScope, $location) {
    $rootScope.$on('$routeChangeStart', function(event, next, current) {
        if ($location.path() == '/login') {
            localStorage.clear();
        }
        if (next.authorize) {
            if (!localStorage.token) {
                event.preventDefault();
                $location.path('#!/login');
            }
        }
    });
}
preAtivador.$inject = ['$rootScope', '$location'];

app.routes.js file

angular.module('ModuloDaApp')
    .config(config);

function config($routeProvider) {
    $routeProvider
        .when('/login', {
            templateUrl: '../views/login.html',
            controller: 'LoginController',
            controllerAs: 'Login'
        })
        .when('/profile/admin', {
            templateUrl: '../views-admin/profile.html',
            controller: 'AdminController',
            controllerAs: 'Admin',
            authorize: true
        })
        .when('/profile/user', {
            templateUrl: '../views-user/profile.html',
            controller: 'UserController',
            controllerAs: 'User',
            authorize: true
        })
        .otherwise({
            redirectTo: '/login'
        })
    // $locationProvider.html5Mode(true);
}
config.$inject = ['$routeProvider']