如何使用 Node js 存储每个用户的访问和刷新令牌（oAuth2）

Question

I'm building a browser based web application that uses a Node server (with express) and integrates with a third-party api using oAuth 2.0. My application does not have any authorization of its own and solely uses the authentication of the third-party software (the application is essentially an extension of this software). I've understood that I should store the Access Token and Refresh Token on the server for security, but how can i remember each user and use their correct Token across multiple api calls from the user to the server? What is the best and most secure way?

Answer 1

There are many solutions to this particular problem:

1. Storing the tokens in the regular database which you use for storing other data :
   PROs and CONs:
   A. Easy way to do as you don't have to install other DB
   B. You need not study other databases and implementation logic
   C. More CRUD load on the same database where your actual data is stored.
   D. Crashing at one side ( because of any reasons like CRUD operation load.. etc ) may cause a complete system down.

2. Storing the tokens in a separate database server which you aren't using for storing any data:
   PROs and CONs:
   A. You have to install and monitor a separate Database server for this particular task.
   B. You may have to read and study about this database to install and implement it in your application.
   C. CRUD operation - load of this database doesn't impact your actual/main database. D. Crashing of one database doesn't impact another database.

These are some main implementation types and still, there are much many for example: creating a separate database in the same database-server for authentication, Storing all the tokens in both the databases and use only auth database ( secondary one for authentication ) for fetching user's tokens etc.

What I prefer is...

1. Having the main database for storing all application-related data.
2. Creating a caching database ( like Redis.. ) to store tokens.
   In this way, I access the tokens in an easy and quick way ( caching databases are much faster ) and I can easily flush whenever needed either through code or through expiration time.

Hope this helps you today...