// the find
sahat/satellizer
Token-based AngularJS Authentication
Satellizer is a JWT-based authentication module for AngularJS 1.x that handles OAuth 1.0/2.0 flows via popup windows, plus email/password login. It was the go-to solution for this problem in the AngularJS era — well-documented, with server-side examples in Node, Ruby, Python, PHP, Go, and Java. The target audience is anyone maintaining a legacy AngularJS app that needs social login without rewriting the auth layer.
The provider abstraction is genuinely well-designed — adding a custom OAuth 2.0 provider is a single config block with no monkey-patching. The popup-based OAuth flow correctly handles the code exchange server-side by default, avoiding the client_secret leakage problem that naive client-side implementations cause. Server examples cover six languages and are complete enough to actually run, not just illustrative stubs. The configurable storage backend (localStorage vs sessionStorage) and token prefix namespacing are small but thoughtful touches that prevent collisions in multi-app environments.
This is a dead project targeting a dead framework — AngularJS reached end-of-life in December 2021, and satellizer's last meaningful activity was years before that. Storing JWTs in localStorage is the default behavior, which is fine for the use case but the README doesn't warn you about XSS implications at all. The `isAuthenticated()` implementation returns true for any syntactically valid JWT regardless of whether your server has revoked it, which is the kind of silent gotcha that bites people in production. There is no PKCE support, which makes the OAuth 2.0 flow non-compliant with current security best practices for public clients.