0

Storing JWT in the server side is a bad practice. But most of the time we say that in the context when the API calls are made from the client side.

Currently I am doing an implementation where from my backend I need to generate JWT token and use in API calls in the server side itself. (Documentation which I am following (Flipkart))

Here the expiry time of my JWT will be 1000 seconds (16.67 minutes).

Problem: Where should I store my JWT once created so that all the multiple client hits use the same JWT until it expires.

Possible Approaches :

  1. Store in the database, which I think will be a very bad decision considering it has to renew every 16 minutes.
  2. Store in the client cookie. But here since its a server to server calls, different client at the same time will have different JWT tokens.
  3. I am using Magento 1.9, and we can store values in sessions, customer-sessions etc. It has same problem as 2nd.

Thus, I am looking for possible approaches which can be followed in this case.

  • why do you need to store the token? Can't you just generate one per request? this way you don't bother with the expiration – Marius Nov 20 '19 at 6:46
  • @Marius Won't it be a very bad practice, generating a new JWT for each api calls to the diff server from each customer, when it already has a expiry time defined. I am a novice, so asking for clarity on this. – arqam Nov 20 '19 at 7:02
  • The expiration date is there in case some tokens "leak". Someone that by any chance gets the token will not be able to use it after a short period of time. I don't think there is a problem in generating tokens per request. (I do it like that). If you want to optimize a bit, in case you need to make multiple calls in the same flow to the third party API, you can use the same token for all calls. But as soon as you start a new flow, you generated a new token. – Marius Nov 20 '19 at 7:05
  • @Marius, Okay, I needed this confirmation. And from flow if I am not wrong then you meant a session right? Like storing the token in the core/session. – arqam Nov 20 '19 at 7:12
  • no. by one flow I mean, one single page request. Or one cli command execution or one single cron execution. Depending on what you are using it for. – Marius Nov 20 '19 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.