title: Architecture for login system on MEAN stack?
body: <p>I'm developing a web app on the MEAN stack (MongoDB, Express, AngularJS, and node.js). I'm developing a login system, and will also have some of the Angular routes protected so that only logged-in users can access them. I'm trying to think of the best way to approach the architecture of this.</p>
  
  <p>I'm thinking of the current workflow:</p>
  
  <ul>
  <li>User logs in via AngularJS form, which sends an http POST to an Express endpoint. The endpoint validates the user against the database, and responds with an OAuth token as well as a cookie. Both are stored in the mongo database for later validation.</li>
  <li>Once AngularJS receives the login response, it stores the received cookie using ng-cookies, and stores the OAuth token in a User service.</li>
  <li>Every time the route changes in AngularJS now, the User service is used to make sure that the cookie is still legitimate by comparing it to cookies in the mongo database (this would be an API call using Angular's resolve... would this create a noticeable lag?)</li>
  <li>When a user clicks "log out" or the cookie expires, the cookie and OAuth token are both deleted from the database and will no longer be valid.</li>
  </ul>
  
  <p>Does this approach make sense? Is it secure, and will it be relatively efficient/quick in execution?</p>