JWT认证策略

Question

Right now I have this confusion whether I should store JWT Token in the session or not

Should I

1. Store it in Redis after Token creation has been made

    // JWT TOKEN token := CreateToken(user) // Storing it in Gorilla Session + Redis s := sessions.Default(c) s.Set("token", token) s.Save() 

So then take the token from the server instead from subsequent request from the request Header

    s.Get("token")
    // and to something with it

2. Pass the Token in Subsequent request so in every route that required The token

    func login(c *gin.Context) { c.Getheader("Authorization") } 

I'm using gin framework

Which approach is better session or subsequent request from user

Regards, Naufal

Answer 1

If you make a client - then YES, as you've obtained the a token, you should store it and pass with subsequent requests.

If you make a server - then NO. You have no need to store a token you've issued, but you should validate it any time you get with a client's request. This way you can make your service stateless and more scalable.

Answer 2

Don't store JWT in sessions.

One important benefits of using JWT is keeping server stateless. Now, If you put JWT in sessions, you are losing the benefits of JWT.

Example:

Say, you have two instances of your server load-balanced. Unless you create some sort of shared session storage, your visitor will have to be forced to visit the same server every time (and that is not easy).