In a Single Page Application should the page reload on login/logout?

Question

I am building an application and I'm using the SPA (Single Page Application) approach. This means my page never reloads and everything is done through AJAX or sockets. However, I do have one exception: The login/logout is done in the traditional way. So, my application is essentially two SPA's one "public" (if you're not logged in) and a "private" (for logged in users).

I was wondering if other people have adopted my approach or if I should instead try to make a single SPA. Here are few advantages/disadvantages I can think of.

Advantages (of having two SPA's)

• When the user opens the public app, he doesn't have to load all of the "private" assets which can be quite substantial. This makes the initial page load faster.
• The page load makes the user feel something has happened. This is hard to explain but, it's kinda like that feeling when you see the gmail loader fill up and your app appear.

Disadvantages

• I think the process of login/logout is slower because each time you have to reload the assets.
• We're breaking away from the SPA approach.
• More server requests which can potentially slow down the server.

So, I'm just curious if you have used my approach before or if there are other pros/cons to add.

Answer 1

I faced that scenario and I found that having an AJAX login is more complex than a refresh login.

A AJAX login requires 2 things:

1. Don't allow the user to access to the related app. You can do this by placing a div in front, but it can be removed by opening the console and delete that login. This means that you have to strictly block access in some way if the user is not logged in.
2. Once the user logs in successfully, you have to load the whole app via AJAX that may produce some issues if your target browsers include IE 8-9.

And a bonus:

3. The response, if the application is kind of heavy, can be much lower than actually loading the app directly, which will affect the user experience.

4. I've never seen an AJAX login.

Answer 2

I was dealing with this a couple of years back - was working on a system that had an Ajax login/logout (using ExtJS) and one that did it with a separate login page.

I can hardly remember any of the reasons, but do remember we had a multitude of issues with the ajax login.

The one I remember the most was security - the submit as done via traditional page refresh is more secure than sending passwords over ajax (effectively making the script aware of the password and letting anyone with access to the computer to see the password in FireBug or Chrome developer tools). There a bit of debate about this on StackOverflow, so would look in there.

I also vaguely recall problems with session timeouts.

I'm sorry that this isn't the most detailed answer, but do make sure that if you do the Ajax login, you are aware of all the complexities.