Does the server need to store token in microservices?

Why store it after the server generates Token ?

from the official documents of JWT, we know that, JSON WEB TOKEN consists of three parts:

  • Header
  • Payload
  • Signature

here we only talk about the saved content in Payload , quoted from the JWT official:

The second part of the token is the payload, which contains the claims. Claims are statements about an entity (typically, the user) and additional metadata. There are three types of claims: registered, public, and private claims.

from this we can see that the Payload part of token has the ability to store user ID, roles. That is, it fully embodies the self-explanatory characteristics of TOKEN .

in that case, why should we persist Token in a cached database like Redis ? Can Token be persisted by the client?

I have consulted my friends, and most of my answers are: access is fast and it is easy to expire .

so let"s assume that if we don"t store Token on the backend, the information in Payload is

.
{
  "id": "1234567890",
  "name": "John Doe",
  "admin": true
  "expire": 1527833009000
}

then when the client carries this token to visit the server, the server performs two steps of processing:

  1. decrypt and verify the Signature part to ensure that token has not been tampered with.
  2. parses Payload data, and determines whether it expires based on the attribute expire .

so can we avoid retrieving token in redis every time the client visits?

now when you visit the server with token on the client side, do you need to go to redis for verification every time?

also in the architecture design of micro-services, the external service may be provided by an API gateway or multiple API gateways, so our Redis must be installed on a separate physical machine or VM, so every time we check the validity of token , do we have to connect to the remote Redis server to retrieve data and then verify it?

Thank you all!

Mar.20,2021

JWT does not need to be stored on the server side, and I wonder why someone would store the token on the server side. And even if it is stored on the server side, it should be encrypted and stored as a password. Otherwise, the database will be obtained by token in hack, and the request can be made by pretending to be a user without a password.


one of the advantages of JWT is that it does not require server-side storage. Token is stored directly on the client side. Each request comes with the last of the three token, segments to verify whether the token has changed, so as to prevent malicious tampering on the client side.

of course, the biggest disadvantage comes from its advantages. The size of the token is proportional to the data it carries, so it is recommended to only save the user's unique logo in it, and check the rest now.

also, there is no soft use for the security issues mentioned above, man-in-the-middle attacks or client attacks.

Menu