3 ms·
It isn't until it is. And wherever you store it is a juicy target.
by recuter 5y ago
It isn't until it is. And wherever you store it is a juicy target.
- zabzonk 5y agoAnd more secure would be....what?
- withinboredom 5y agoNot localstorage. :) I've seen them in http-only cookies which is sent with every request but not inspectable by js. The server can automatically refresh the token every-so-often transparently without the client even being aware or able to influence it in any way.
- mike-cardwell 5y agoWhen will "until it is" kick in? It has never kicked in for me...
- zimpenfish 5y agoI've worked at a couple of places where the session token lookups were the bulk of database traffic - to the extent that one place had to split it off to its own cluster just to stop it clogging everything up.
- gary_0 5y agoWouldn't you just store it in the same place you're storing the main authentication data (eg. password hashes)? [edit] I guess that database would get hammered pretty hard on every request, unless you use caching... which might be what you're getting at.
- recuter 5y agoI'm sure tptacek will be along shortly to elaborate. One would think it gets stored in the database, but man all these hashes are so slow to generate. And which library are we using again for that? bcrypt? scrypt? Seems unnecessarily slow. I bet SHA256 is good 'nuff, and way faster. Lets just meanwhile call the cloud consultant to move this to a separate service. Have you heard the good word about AWS Cognito? I heard its web scale. Nah, too expensive, we should just write our own real quick how hard can it be..
- icedchai 5y agoMost sites would be lucky to have this problem. Store your sessions in redis and call it a day.