Documentation
Guides
Authentication

## JWT

Fuse provides an implementation for JWT authorization. You can immediately hook up your backend API where you generate a JWT token and send it back and start using Fuse's JWT implementation.

This implementation of JWT can be found within `app/core/auth/` directory. Here's the quick overview of provided files:

- Guards:

  auth and noAuth guards to protect the routes.

- AuthInterceptor

  An interceptor to attach the access token to the header of the requests and catching 401 responses.

- AuthService

  A service for signing in and out as well as checking the authenticated status of the user.

- AuthUtils

  Set of utilities to decode the JWT token.

## Setting up

### 1. Set up your backend API

Before start doing anything within Fuse, prepare your backend API. You will need API endpoints for signing in, signing out and refreshing the token. These will usually be provided with your choice of JWT backend implementation by default so you don't have to do too much work.

### 2. Configure the AuthService

AuthService includes methods for signing in and out as well as refreshing the token. Edit the AuthService file and change the API endpoints so the requests can go through.

And that's pretty much it! You can now sign in, sign out and refresh the access token.

## A note about storing the access token

Fuse stores the access token in the local storage. There are a lot of debates going on about whether it is safe or not to store it in the local storage. We believe it doesn't matter. Javascript always going to be executed in the browser, it doesn't matter where you store the JWT token, whether in the local storage or in the memory as a variable, it can always be accessed and read!

The only thing you have to be careful about is to protect your app against attacks like XSS, CSRF or XSRF. Angular does an amazingly good job to protect you against these attacks by default but still, you have to be careful what to include into your app. And if you happen to have a security hole that can cause these attacks and allows attackers to run their own Javascript code on your app, local JWT token is going to be the least of your worries.

## Refresh token

Refresh token is another type of token that usually sent with the access token when you first login and it allows refreshing the access token.

We are not going to go into any details about it since you can do your own research, but the premise is, you store the refresh token in an HTTPOnly cookie which will be automatically added into the header of any request and can be used to sending back a fresh access token from your backend API if needed.

Since Javascript cannot read or write HTTPOnly cookies, refresh tokens can only be accessed and set via the requests and responses by your backend implementation. Basically, the refresh token implementation needs to be done in your backend, there is nothing that can be done in Fuse or in Javascript.