3 ms·
I hit the database on requests - I keep their identity in the JWT but not their permissions. And if they're hitting a protected route (the only time their ident
by seangrogg 10y ago
I hit the database on requests - I keep their identity in the JWT but not their permissions. And if they're hitting a protected route (the only time their identity is necessary anyways) you best be sure I'm checking their canonical permissions.
- cortesoft 10y agoYou might be, but many people use signed cookie sessions in order to avoid having to check the DB.