I have used JWT in my application and found it interesting as they don't require a database lookup, which makes them faster and puts less load on the database.

A major concern with JWT is related to security reasons for my application which is REST API's based where user needs have a token with them to access those endpoints. If a token is accidentally leaked I need to make another table in the database and verify if an incoming token is valid or not which is kind of similar to authenticate a user from a database.

I can use some cache-based databases like Redis and make operation faster but is there some alternative so that I can minimize database read/write operations?

Technically you need something to validate the incoming token which can be done with some public/private key similar to JWT but the problem lies while changing the key.

How does Facebook/Twitter or similar manage access token for their app(not mobile app 🙂)? Do they make a query with their database or have something similar to JWT. (This part of the question is just for a hint to get their implementation method and not as an opinion or something to invalidate this question, a part can remain unanswered).

  • Have you tried looking for exactly this information "How does Facebook/Twitter or similar manage access token for their app"? – kutschkem Dec 4 '19 at 9:17
  • You cannot avoid database lookups altogether. It's either whitelist (normal sessions) or blacklisting (signed tokens). Either way, something needs to be looked up. And that something can of course be cached in a number of ways to avoid hitting the database. – oligofren Dec 4 '19 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.