'Angular Auth Token and Visible data client side

I have come across a concern on an API project currently. I am newer to angular, so bare with me please. The data is storing in a static file our cient_id and secret key. You can view this in developer tools. Now I know there is no safe way to store data client side and hence encrypting takes a key to pass etc. Also should use tsl and so on.

My question (and is based around lack of knowledge of oauth and tokens) is would it be possible or reasonable to handle a situation like this in the manner below:

  1. User Login request sent
  2. Server validates and returns auth token to api controller
  3. Prior to returning to UI JS side we encrypt in code behind.
  4. Only the encrypted value is stored in client side.
  5. Any request needing the AUTH token hits a anonymous api, then decrypts in code behind to get your client key, secret and other data.
  6. At this point if valid then continues to targeted api call, does its work, returns data to UI again.

Does this concept make sense or no due to again my lack of knowledge in this arena?

Thanks in advance!



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source