title: AngularJS - Server side index.html and authentication
body: <p>After watching the AngularJS "Massive AngularJS apps" presentation (<a href="https://docs.google.com/file/d/0B4F6Csor-S1cNThqekp4NUZCSmc/edit" rel="nofollow noreferrer">https://docs.google.com/file/d/0B4F6Csor-S1cNThqekp4NUZCSmc/edit</a>),
  I was attempting to implement the following scenario</p>
  
  <p>1) User requests index.html (Server side generation)<br>
  2) Flask checks if authentication cookie is present<br>
  3) If cookie is missing, redirect to login.html (also server side generated)<br>
  4) On login page, POST the login information.<br>
  5) Flask verifies user + password -> sets cookie, redirects to /<br>
  6) Flask checks cookie, retrieves user profile + generates index.html<br>
  7) Client app starts<br>
  8) Client is expected to do a call to /token (with cookie)<br>
  9) Flask verifies request, generates new access + refresh token &amp; expires init cookie<br>
  10) Client receives tokens &amp; can do normal REST calls with basic auth header using the tokens  </p>
  
  <p><em>The problem I had is was implementing the way of maintaining authentication once the index.html has to be generated.
  I proposed to include the token in the profile of the index page (as a javascript variable), and when angularjs configures, and copy it to the window.session storage but I'm was not too sure about how secure it is?</em></p>
  
  <p>Is this is an acceptable flow security wise and/or there better ways?</p>
  
  <p>EDIT: Updated question + Added the flow I would use as a sequence diagram:
  EDIT2: I noticed I can't reload the page since the cookie will be expired, so I'm starting to doubt the use of access tokens..</p>
  
  <p><img src="https://i.stack.imgur.com/tLj1h.jpg" alt="Login flow"></p>