使用 session 变量（Express/NodeJs）进行用户身份验证

Question

Using session variables to remember login in the backend is a bad idea?

Is it good? What about security? Or alternatives?

Backend: Express (NodeJs) Frontend: MaterialUI (React)

I am looking for a simple way to check access before entering and then remebering logged user.

I'm junior. Many thanks for the advices.

I can easily do it. It's already done. But I am worried about security problems or other.

Answer 1

The issue with session variables is that you are designing a single point of failure and you will be facing scalability issues later on. That means if your server goes down, all the user's data stored in a session variable will be lost.

Scalability Issues

Let's say you have two servers, Server A and Server B, with a load balancer that routes requests to your servers. The first request User A makes hits Server A; you create your session variable and store all the related data to that user in Server A. Now, on the second request, assume the request hits Server B, now Server B has no idea that there is such data about this user, whether that user is logged in, has proper authorizations, etc.

Solution

Solution 1: In case you still want to use session variables, you have to deploy a caching server like memcached or Redis to store the session variables related to your users. What happens then in regards of scalability is that your servers will subscribe to this caching server and they will all have access to any data stored about any user by any server. In terms of security, you should not be relying on the client at all. You should be trusting your servers and your code to handle proper authentication and authorizations.

Solution 2: You can store a JWT token in a cookie. On each request, you fetch the token from the cookie, verify the token, and fetch any other data about that user. At this point, you don't even need Redis because this token will be stored on client side; whether Server A or B gets the request, they can both verify it without an issue. However, you have to be careful on how you issue, sign, verify, and handle tokens. Also, you have to transmit tokens over HTTPS.