News for hackers. Stuff that matters.

A comment on Should I Use jwts For Authentication Tokens?. Parent comment

Re:Should I Use jwts For Authentication Tokens? by andrewmcwatters on Tuesday May 28, 2024 @11:20AM (#40501590)
It’s bullshit. A majority of high volume systems can do this just fine. This is just engineering wank.

Standard solution is query a session table on from a single location, and once you actually start to need to trim request time, it’s not even the first place you look.

[ Parent | on HN ]
Re:Should I Use jwts For Authentication Tokens? by jupp0r on Tuesday May 28, 2024 @03:41PM (#40504740)
Assumptions you are making:

* everything is located physically close together (good luck reading from a DB table in Singapore from a service in Europe for every request)

* you have few enough client services that want to do this that the number of db connections does not become a problem (this is 100 by default for Postgres, you might need to tune this or deploy proxies, etc)

* high availability is already taken care of (you don't want that one DB server to bring down everything in case of a failure)

[ Parent | on HN ]
Re:Should I Use jwts For Authentication Tokens? by leshenka on Tuesday May 28, 2024 @07:14PM (#40506586)
several comments up this branch we were talking about middle ground, remember
[ Parent | on HN ]
Re:Should I Use jwts For Authentication Tokens? by jupp0r on Tuesday May 28, 2024 @10:46PM (#40507905)
Yes. It's super common for SaaS companies that are <1% the size of Google to have infrastructure in multiple regions.
[ Parent | on HN ]