Will add to what @sudheendra suggests.
Yes. Keep it stateless, as much as possible. If you can't, I suggest a few options:
- Leverage JWT claims to store non-sensitive data. That way you can pass the token id around to third-party systems and remove the dependency on a server.
- Maintain state on the server-side.
- By associating attributes to access token. OAuth policy supports this feature.
- Keep state on the server with KVMs or cache leveraging cookies. Not a big fan of this one, but I've been on projects where this was required.
- Maintain sessions on the client side.
- Leverage browser local storage. I'm an advocate of this one for many use cases.By using client-side sessions, your backend can scale as it won't have to keep track of any state. A cluster of thousands of microservices can receive your requests without the need of tracking sessions on the server side. And the best part is that it can be secure. Take a look at Using secure client-side sessions to build simple and scalable Node.JS applications to learn more.
Let us know your thoughts!
LinkedIn
Twitter
