4 ms·
How would you handle user authentication on a serverless platform? JWT are imo perfect for that since they are stateless.
by super256 4y ago
How would you handle user authentication on a serverless platform? JWT are imo perfect for that since they are stateless.
- xorcist 4y agoHow do you handle logouts?
- ffo 4y agoWell, when dealing with OIDC / OAuth you can bind the tokens to the user session or trigger back channel logouts. But anyways its not really easy to tell an RP to stop using a token.
- dns_snek 4y agoI'm not the person you replied to, but in most implementations I've seen - they don't. Front end or app is politely asked to delete the token to simulate the user logging out, but the token isn't revoked in any meaningful fashion. No additional checks are performed on the back-end to verify whether the token has been revoked as that would reintroduce a round trip to the database you're trying to avoid in the first place.
- 9dev 4y agoIssue tokens that have a reasonably short TTL - say, half an hour - and let clients use their refresh token to obtain a new token after that. On refresh requests, ask the database whether the refresh token has been invalidated, if it is, return 403 (bonus points for checking the expiration date first and delete expired and invalidated tokens from the invalid-list). This reduces the necessary database roundtrips, while still supporting a logout flow.
- ryeguy 4y agoThis also means an attacker can be running around with a compromised token for up to a half hour before they're stopped.
- 9dev 4y agoIf that is unacceptable for the business case, it's probably clear JWTs for sessions are unfit for the particular task?
- frankthedog 4y agoIs it acceptable for any business to allow accounts to be compromised for a half hour?
- 9dev 4y agoI'd actually argue that yes, that is acceptable for more businesses than you might think. We're talking about a session staying usable after logging out for 30 minutes in the worst case. For this to be exploitable, you'll have to jump several other hoops, like accessing localStorage of another application, for example.
- fknorangesite 4y agoNo one - OP included - is arguing that there are no good use cases at all. Just that most situations don't call for it, and you're better off with something less complex.