JSON Web Tokens should be avoided

Re:JSON Web Tokens should be avoided by chmike on Tuesday March 14, 2017 @11:29AM (#13868279)

When the authentication info needs to be used with servers in different location of the world, JWT is better. Getting the session info from a redis server or something equivalent isn't free. Deciphering a JWT token may be faster. So, the most appropriate method depends on the use case.

If all the servers are in one location, a random byte sequence as session id key with cached info is the most simple, compact and efficient.

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by jjawssd on Tuesday March 14, 2017 @11:57AM (#13868609)

Or you can use read only Redis replication and keep your architecture pretty much the same https://redis.io/topics/replication

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by daenney on Tuesday March 14, 2017 @12:52PM (#13869191)

What happens when that replication breaks? Can people still log in? Can you still validate their sessions? Or are you going to have an outage in a geographical region?

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by jjawssd on Tuesday March 14, 2017 @01:30PM (#13869585)

Fall back to connecting to the main instance directly

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by tracker1 on Tuesday March 14, 2017 @02:19PM (#13870022)

And if the replication is down because the main instance can't be reached for a minute?

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by jjawssd on Tuesday March 14, 2017 @07:49PM (#13872630)

And if your user base is hit by a nuclear bomb?

[ Parent | on HN ]