title: $http request is passed to the server in angular js without specify it on the client side
body: <p>I saw a demo of an authentication using angular js and JWS auth02 metodología and I refocterd it a little...
  I am using express (node js) on the server side to define myApp.</p>
  
  <p>my question is this - on the client side I am doing this http GET call:</p>
  
  <pre><code>   $http({url: '/api/restricted', method: 'GET'})
      .success(function (data, status, headers, config) {
        $scope.message = $scope.message + ' ' + data.name;  
      })
      .error(function (data, status, headers, config) {
        alert(data);
      });  
  </code></pre>
  
  <p>on the server side I am getting the id from the http GET request:</p>
  
  <pre><code>app.get('/api/restricted', function (req, res) {
     res.json({
      name: req.user.id
    });
  });
  </code></pre>
  
  <p>and it is working.. the only problem is that I don't see where I defined a GET request with a user entity... all I see is that the GET http request get a method and a url:</p>
  
  <pre><code>   $http({url: '/api/restricted', method: 'GET'})
  </code></pre>
  
  <p>so where is this magic     <code>name: req.user.id</code></p>
  
  <p>is coming from?</p>
  
  <p>Thanks...</p>
  
  <p>more of the code (may be relavent...):</p>
  
  <p>index. html</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
    &lt;head&gt;
      &lt;meta http-equiv="content-type" content="text/html; charset=utf-8" /&gt;
      &lt;title&gt;Angular Authentication&lt;/title&gt;
      &lt;script src="//ajax.googleapis.com/ajax/libs/angularjs/1.5.8/angular.min.js"&gt;&lt;/script&gt;
      &lt;script src="./auth.client.js"&gt;&lt;/script&gt;
      &lt;script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/angularjs/1.5.8/angular-cookies.js"&gt;&lt;/script&gt;
    &lt;/head&gt;
    &lt;body ng-app="myApp"&gt;
      &lt;div ng-controller="UserCtrl"&gt;
        &lt;span ng-show="isAuthenticated"&gt;{{welcome}}&lt;/span&gt;
        &lt;form ng-show="!isAuthenticated" ng-submit="submit()"&gt;
          &lt;input ng-model="user.username" type="text" name="user" placeholder="Username" /&gt;
          &lt;input ng-model="user.password" type="password" name="pass" placeholder="Password" /&gt;
          &lt;input type="submit" value="Login" /&gt;
        &lt;/form&gt;
        &lt;div&gt;{{error}}&lt;/div&gt;
        &lt;div ng-show="isAuthenticated"&gt;
          &lt;a ng-click="callRestricted()" href=""&gt;Shh, this is private!&lt;/a&gt;
          &lt;br&gt;
          &lt;div&gt;{{message}}&lt;/div&gt;
          &lt;a ng-click="logout()" href=""&gt;Logout&lt;/a&gt;
        &lt;/div&gt;
      &lt;/div&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>client side</p>
  
  <pre><code>myApp.controller('UserCtrl', ["$scope", "$http","$window","$cookies", function ($scope, $http, $window,$cookies) {
    $scope.callRestricted = function () {
      $http({url: '/api/restricted', method: 'GET'})
      .success(function (data, status, headers, config) {
        $scope.message = $scope.message + ' ' + data.name;  
      })
      .error(function (data, status, headers, config) {
        alert(data);
      });
    };
  
  myApp.factory('authInterceptor',["$rootScope", "$q","$cookies", 
    function ($rootScope, $q,$cookies) {
      return {
        request: function (config) {
          config.headers = config.headers || {};
          if ($cookies.get('token')) {
            config.headers.Authorization = 'Bearer ' + $cookies.get('token');
          }
          return config;
        },
        responseError: function (rejection) {
          if (rejection.status === 401) {
          // handle the case where the user is not authenticated
        }
        return $q.reject(rejection);
      }
    };
  }]);
  
  myApp.config(function ($httpProvider) {
    $httpProvider.interceptors.push('authInterceptor');
  });
  </code></pre>
  
  <p>and this code on the server side:</p>
  
  <pre><code> var express = require('express');
  var bodyParser = require('body-parser');
  
  var jwt = require('jsonwebtoken'); 
  var expressJwt = require('express-jwt'); 
  
  var secret = 'ssasDSA223Sasdas2sdsa23123dvxcgyew231';
  
  var app = express();
  
  // We are going to protect /api routes with JWT
  app.use('/api', expressJwt({secret: secret}));
  
  app.use(bodyParser.json());
  app.use('/', express.static(__dirname + '/'));
  
  app.use(function(err, req, res, next){
    if (err.constructor.name === 'UnauthorizedError') {
      res.status(401).send('Unauthorized');
    }
  });
  
  app.post('/authenticate', function (req, res) {
    //TODO validate req.body.username and req.body.password
    //if is invalid, return 401
    if (!(req.body.username === 'john.doe' &amp;&amp; req.body.password === 'foobar')) {
      res.status(401).send('Wrong user or password');
      return;
    }
  
    var profile = {
      first_name: 'John',
      last_name: 'Doe',
      email: 'John.Doe@gmail.com',
      id: 333333333
    };
  
    // We are sending the profile inside the token
    var token = jwt.sign(profile, secret, { expiresInMinutes: 60*5 });
    res.json({ token: token });
  });
  
  app.get('/api/restricted', function (req, res) {
     res.json({
      name: req.user.id
    });
  });
  
  app.listen(8080, function () {
    console.log('listening on http://127.0.0.1:8080');
  });
  </code></pre>