API with NestJS #3. Authenticating users with bcrypt, Passport, JWT, and cookies

Re:API with NestJS #3. Authenticating users with bcrypt, Pas... by dvdhnt on Monday May 25, 2020 @11:51AM (#23302231)

Side note, the idea of JWT without verifying the token against a database, made me doubt what I was doing.

I wasted too many cycles trying to understand how it was secure while debating how much latency my database check was introducing on every single request compared to those simply using the JWT as-is.

It has made something I considered "settled" to be a time-sink.

[ Parent | on HN ]

Re:API with NestJS #3. Authenticating users with bcrypt, Pas... by karatestomp on Monday May 25, 2020 @12:05PM (#23302363)

They don't make a ton of sense until your public-facing services get kinda mesh-like. If it's all in one DB, including authorization and authentication data, and you never have one service requesting resources from other services on behalf of a user, they're probably overkill and regular sessions would be fine.

(Nb. I've not personally seen them used in a case for which they make sense, yet, but only in smaller projects because they're trendy)

[ Parent | on HN ]