database - Can I just create and store list of auth tokens instead of using JWT and similar? -
i'm creating first spa using nodejs stack development , came point should design authentication , secure parts of app.
read lot auth techniques including jwt, oauth, etc. still didn't find «a real world example».
let's assume task secure parts of app public. app isn't designed work 3rd party services see no need use google or facebook auth. want use login/password , store data using own database server.
don't understand point of having authentication stateless. came simple conclusion can design authentication in way:
- i store users logins , passwords in database.
- user auth means user enters credentials, server checks , creates token. server saves token database. user saves token using browser local storage or somewhere else if it's not browser environment.
- on each request client sends token, server checks token exists , responds appropriately.
- user can login different devices, create multiple tokens him.
- we can end specific session or sessions deleting user tokens database.
- we can manage tokens in way want, example server can check expiration time , invalidate (delete) token.
is ok? jwt require additional implementation if need invalidate token, saw different examples, of them based on storing invalid tokens what's point of if can store valid tokens? lose statelessness implementing storage.
see can use cookies instead of implementation described above don't idea use cookies in restful app because depends on browser-like client environment.
disadvantages of storing tokens on server?
i have implemented 1 project in user authentication required , token stored database.
you can find example here.
Comments
Post a Comment