We are creating a project using Aurelia/Typescript. For those who don't know what that is, it's basically a better AngularJS (opinionated). Our project runs perfect, except for the fact that we need to incorporate windows authentication now, which we can get via ASP.NET Core. This is a bit of a problem. Considering that we are using Typescript, which gets compiled for us into javascript, how can we access our windows auth user from Aurelia/Client-side?

Reason being that we are calling API's from the client-side using Aurelia and for certain api's, we need to be able to pass in the user authentication. The only solution I've come up with is passing the user thru the URL as a parameter and trying to access it from Aurelia. This does not sound like a good idea, but we've struggled to find another solution. Any ideas?

  • Is the question "How do I get the login name in my server side code so I can pass it back to the client?" Or is it, how do I pass the login name back to the client? Or is it how do I make this state information available on the client side in a way that does not break when the user does Refresh or navigates? Could be all of the above, I suppose. – joshp Apr 5 '17 at 23:52

We are in the similar situation, using ASP.NET Core for server side and Aurelia for the client. We will probably not use Windows authentication, but I was thinking, how I could do that.

On the server side we have single MVC controller and View (Index.cshtml) to host the Aurelia SPA. So the idea was to authenticate the user on the server and render the user information into the Index.cshtml as a global JavaScript variable. This should be easily accessible from your TypeScript code.

Index.cshtml: (ASP.NET MVC)

<script type="text/javascript"> 
  // Create global variable to store user info.
  var UserInfo = { Login: '@(Model.Login)', Email: '@(Model.Email)'  };

Home.ts: (Aurelia)

declare var UserInfo: any; // Tell TS the variable is already defined elsewhere.

export class Home {
  name: string;
  email: string;

  constructor ()
    this.name = UserInfo.Login;
    this.email = UserInfo.Email;


Other idea (I didn't tried it yet) would be to pass the user info in cookies or session storage.

This is not recommended if you need to pass sensitive information!

  • 2
    Yeah, this doesn't look like a very good security model. – Robert Harvey Dec 6 '16 at 20:42
  • This is not supposed to be a security model. Security has to be always done on the server. This is just a way how to pass to the client who is or is not authenticated. Out of principle, no client will ever be secured. – Tom Shane Dec 6 '16 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.