This will be very very strange statement to many readers. How an USERS table would miss such critical column? I hope in a few lines you can get the point of it.
However strange, keeping the authentication out of your API databases could be a smart approach:
- The platform is publicly accessible, by real people, programs or entities capable of making use of it.
- There is real chance that the platform is targeted to obtain it's sensitive data.
- The platform is distributed in different APIs, Web user's interfaces, processes, CLI tools, you name it.
Well, and then, how we provide an authentication mechanism to access the platform?
Use an identity and access management (IAM) such as Keycloak (however there are plenty of alternatives out there, also open source)
Why take the overhead to use another service for authentication?
- These are reality proven secure services, afford that these teams and their investors can put much more resources to keep them safe.
- Their flexibility is something that you may not need, but if you finally find out you need third party authentication, applications, more than one realm, this will do.
- You can provide your own JWTs but if your platform is complex enough a authentication endpoint will be needed.
There is however an issue of using this approach: JWTs are self-contained, so they stay valid until they expire — even after the user logs out. Common mitigations:
- Short-lived access tokens + refresh tokens; revoke the refresh token on logout.
- A denylist of revoked token ids (jti).
- If you need instant revocation, trade statelessness for Keycloak's token introspection endpoint (RFC 7662).
Hope this will help you if you didn't knew about it, for sure this was helpful for me.
Top comments (0)