3 ms·
Wouldn't you just store it in the same place you're storing the main authentication data (eg. password hashes)? [edit] I guess that database would get hammered
by gary_0 5y ago
Wouldn't you just store it in the same place you're storing the main authentication data (eg. password hashes)?
[edit] I guess that database would get hammered pretty hard on every request, unless you use caching... which might be what you're getting at.
- recuter 5y agoI'm sure tptacek will be along shortly to elaborate. One would think it gets stored in the database, but man all these hashes are so slow to generate. And which library are we using again for that? bcrypt? scrypt? Seems unnecessarily slow. I bet SHA256 is good 'nuff, and way faster. Lets just meanwhile call the cloud consultant to move this to a separate service. Have you heard the good word about AWS Cognito? I heard its web scale. Nah, too expensive, we should just write our own real quick how hard can it be..
- icedchai 5y agoMost sites would be lucky to have this problem. Store your sessions in redis and call it a day.