2 ms·
> Servers must ... make DB calls to verify the user is still active I'm not being facetious, genuinely asking - is this a big deal? Should be a pretty cheap qu
by carter2099 4mo ago
> Servers must ... make DB calls to verify the user is still active
I'm not being facetious, genuinely asking - is this a big deal? Should be a pretty cheap query, and with pooled connections, hardly any overhead.
- owaislone 4mo agoDepends. If you backend is just one service, it is not a big deal but then you don't JWT at all. You just need a regular cookie/token. If your backend is a set of 12 services where each needs to verify the authenticity of the request then it might start adding up. In that case using JWT _after_ the initial API gateway makes a lot of sense. The gateway hits the DB, authenticates the request, mints a JWT and injects it into downstream requests. Then each service on the request path just verifies the JWT. Overall I don't think hitting the DB for auth is a big deal and that is why we don't need all the bells and whistles JWT brings. Just use bearer auth.