What strategy to use to let Angular know user is logged in when using (Spring)...

I have the beginnings of an App. I have been focused on authorization the last month or so.

Currently, the authentication flow is like this.

1. Astro page (SSG) - has a login button, that the user clicks on in the Browser
2. The Browser then calls the auth endpoint on my Spring Security (Java/Kotlin) Server
3. The Spring backend creates a session cookie, and stores an empty session with that ID in Redis. It then sends a response (with the session cookie) back to the browser to authorize with Auth0
4. The Browser page lands on Auth0, and the user logs in.
5. Auth0 then redirects the browser back to the Spring BFF, (the browser in the request, also sends the originally generated Session Cookie) to the Spring BFF
6. The Spring BFF does a Token Exchange directly with Auth0, and stores the Access Token, and ID Token from Auth0, directly in Redis, with that users associated Session ID.
7. On successful Token exchange, finally the Spring BFF redirects to a landing page at Angular.

Now, what strategies can Angular use, to know that a user hitting the landing page endpoint (or indeed any endpoint in the app) genuinely logged in to Auth0? The existence of the session cookie isn't really enough, as that gets generated and send to the browser BEFORE the user enters their Auth0 credentials. Currently the session cookie has a lifespan of 30 mins. And the session that gets created in Redis, also a 30 min TTL (time to live) with a 5 minute skew (so I think 35 mins)

Any suggestions would be welcome.

Thanks in advance!

Continue reading...