5

I am building an application and I'm using the SPA (Single Page Application) approach. This means my page never reloads and everything is done through AJAX or sockets. However, I do have one exception: The login/logout is done in the traditional way. So, my application is essentially two SPA's one "public" (if you're not logged in) and a "private" (for logged in users).

I was wondering if other people have adopted my approach or if I should instead try to make a single SPA. Here are few advantages/disadvantages I can think of.

Advantages (of having two SPA's)

  • When the user opens the public app, he doesn't have to load all of the "private" assets which can be quite substantial. This makes the initial page load faster.
  • The page load makes the user feel something has happened. This is hard to explain but, it's kinda like that feeling when you see the gmail loader fill up and your app appear.

Disadvantages

  • I think the process of login/logout is slower because each time you have to reload the assets.
  • We're breaking away from the SPA approach.
  • More server requests which can potentially slow down the server.

So, I'm just curious if you have used my approach before or if there are other pros/cons to add.

2
  • 1
    The point of logging out is to get rid of the data on screen, so I think most people would want the page to refresh...possibly to a mostly blank 'you have successfully logged out' type of message.
    – DA01
    Mar 21, 2014 at 20:55
  • I have a similar app and I have a separate login page precisely for the advantages you list above. Plus I think it is safer.
    – pathfinder
    Mar 22, 2014 at 2:29

2 Answers 2

3

I faced that scenario and I found that having an AJAX login is more complex than a refresh login.

A AJAX login requires 2 things:

  1. Don't allow the user to access to the related app. You can do this by placing a div in front, but it can be removed by opening the console and delete that login. This means that you have to strictly block access in some way if the user is not logged in.
  2. Once the user logs in successfully, you have to load the whole app via AJAX that may produce some issues if your target browsers include IE 8-9.

And a bonus:

  1. The response, if the application is kind of heavy, can be much lower than actually loading the app directly, which will affect the user experience.

  2. I've never seen an AJAX login.

5

I was dealing with this a couple of years back - was working on a system that had an Ajax login/logout (using ExtJS) and one that did it with a separate login page.

I can hardly remember any of the reasons, but do remember we had a multitude of issues with the ajax login.

The one I remember the most was security - the submit as done via traditional page refresh is more secure than sending passwords over ajax (effectively making the script aware of the password and letting anyone with access to the computer to see the password in FireBug or Chrome developer tools). There a bit of debate about this on StackOverflow, so would look in there.

I also vaguely recall problems with session timeouts.

I'm sorry that this isn't the most detailed answer, but do make sure that if you do the Ajax login, you are aware of all the complexities.

4
  • +1 "the submit as done via traditional page refresh is more secure than sending passwords over ajax"
    – Misters
    Jun 5, 2014 at 12:39
  • The security of the postback login comes from being able to set HttpOnly cookies, which you can't do with an XHR. You don't need to a do a whole page refresh though if you log in through an <iframe>, which is perfectly capable of setting the right auth cookie. Aug 3, 2015 at 17:38
  • 2
    Again, I'm not 100% knowledgeable on this issue. But the developers I work with say that it marks no difference nowadays: Ajax or not - it's a request made to the server and would be equally secure if implemented correctly.
    – Izhaki
    Aug 10, 2015 at 21:23
  • 1
    Another problem is that Chrome and other browsers don't offer to remember passwords if you submit the form by AJAX. Mar 23, 2019 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.