fnakstad / angular-client-side-auth

One way to implement authentication/authorization in Angular applications
http://angular-client-side-auth.herokuapp.com/
MIT License
1.63k stars 346 forks source link

When a templateUrl is not found, Angular renders 'index' within 'index' forever. This kills the brower. #60

Open elliottregan opened 10 years ago

elliottregan commented 10 years ago

This is a very simple mistake that I made, but it could potentially come up in production and its a browser crashing one.

I overlooked the fact that Angular's templateUrls for its routes.js are defined at the bottom of index.jade. When I tried creating a new view and simply using "new_page" for the templateUrl in routes.js (thinking Express was working some file type independent magic), Angular would route to "new_page", which would cause the server to respond with its "catch-all" which is "index". This loads Angular again, and the cycle continues until the browser crashes or stops the script.

Obviously in this case it was just a stupid mistake, but I feel like it should have defaulted to a 404, or something more graceful. I feel like this has the potential of happening in production... Any thoughts on how to catch this loop if it happens?

fnakstad commented 10 years ago

This is a rather nasty bug if you do end up with a mistake in your routing setup, but I don't have a good solution for it yet as this is the only way the server can delegate routing of "pretty, html5mode" URL's to the client side (not using the hash symbol for client-side routes). The only solution I can think of is if the server somehow had knowledge of the routes registered on the client-side... Then it could return a 404 for any routes it knew the client would not be able to respond to. I'll think about it some more and leave this issue open in case anyone else has any good suggestions!

austinpray commented 10 years ago

Note: when html5mode is turned off this happens as well. The automatic forward slash adding rule causes it. Just try turning html5mode off and loading a page you aren't supposed to have access to.

anttoon commented 9 years ago

+1