Anyone securing an Angular application

[Cantor, Scott]

On 7/20/18, 10:57 AM, "users on behalf of Starkey, Don [BSD] - CRI" <users-bounces at shibboleth.net on behalf of dstarkey at bsd.uchicago.edu> wrote:

> Are you saying that you cannot secure a client side  application run in the browser with shibboleth?

You can't secure *any* web application in a client with *anything*, it's a physically impossible thing to do. The client is the client, it's controlled by the user. Users don't authenticate to the client, they authenticate to servers, and then the clients of those servers maintain cookies and tokens to contact servers using that security context.

But in actual fact, I doubt very seriously your goal is to secure the client side, it's almost certainly to secure some API calls the client is making to a server, and that is almost certainly not anything Shibboleth will address because the people behind those APIs are dictating some specific form of security you have to use.

But that's purely a guess.

-- Scott