News for hackers. Stuff that matters.

A comment on Show HN: Haproxy-auth-request – HTTP access control using subrequests. Parent comment

Re:Show HN: Haproxy-auth-request – HTTP access control using... by jsiepkes on Friday January 19, 2018 @05:03PM (#16190258)
I think performance is not the main reason for going stateless for most people. With stateless you can more easily achieve HA of your auth server. Since it is all stateless your auth servers dont need to know about each other. However with stateful you need somesort of special HA construct between instances of your auth servers otherwise they don't know which sessions exist.
[ Parent | on HN ]
Re:Show HN: Haproxy-auth-request – HTTP access control using... by je42 on Saturday January 20, 2018 @08:43AM (#16193290)
in a state less auth layer you can't do blacklisting of token. hence if your security requirement are somewhat in the "safer" ranger. you will need to use a bit of state to whitelist or blacklist tokens.
[ Parent | on HN ]