4 ms·
You have to be pretty big before "store the session information in Redis" doesn't work anymore.
by nicoburns 2y ago
You have to be pretty big before "store the session information in Redis" doesn't work anymore.
- bitexploder 2y agoAnd most of these session mechanisms are easy to work with as middleware in common web app frameworks making it pretty simple to stick with simpler sessions if everyone can get to the session store. Everyone way over complicates authn and sometimes barely even think about authorization. I have seen many a web app with poor JWTs implementation and abusable authz get broken. Sometimes the apps warranted the JWT implementation but it is a lot harder than many devs think.
- zaat 2y agoThat was a battle I fought with some developer consultancy not long ago. I won't tell the whole story, but I will say that if you have issue with JWT tokens that are too big due to the number of groups each user have, you probably do need to use JWTs and you are most definitely doing it wrong and should educate yourself or bring a consultant who at least get the difference between authentication and authorization.
- bitexploder 2y agoI made a lot of money in my life because I knew the difference. Oh and XSS, paid the bills for a couple decades :)
- keredson 2y agoor you have crappy code that can only handle a dozen RPS. [facepalm]
- nicoburns 2y agoI mean, if anything this just means that session storage won't be your bottleneck.
- jupp0r 2y agoOr just have infrastructure that needs to validate the session in different parts of the continent (world).
- seabrookmx 2y agoAs far as system load sure. Not so much uptime.. keeping your session in Redis creates a single point of failure. HA/Clustered Redis exists but definitely has some associated complexity.