我想限制用户通过API访问其他用户的数据

Question

I have implemented token based authentication and authorization. I am storing the value of token in session. How to restrict a user to access the data of other users if user gets the token. I am passing token only in header. So if user is able to get the token value anyhow so he can access any API for any user. I am calling apis in jQuery.

Answer 1

First of all, why do you save the value of the token in a session? That doesn't make sense, since your authorization becomes session dependent, not token dependent. If you exchange password and username for token, don't use sessions as the token becomes redundant - you are authorizing the user through your session cookie.

Also, this is the idea of the token - to be working just for an hour (most services use this amount of time for the token life). So if you are not implementing an OAuth authentication strategy, why use tokens in the first place? And if you do, why use sessions? I think you are mixing different approaches here.