How to I handle user authentication in microservice pattern? I have

Question

How to I handle user authentication in microservice pattern? I have

auth service which is will signin user and send a jwt to the client. I have set an expiration time of 5 mins. Now there is also a refresh token generated which is of 3 months. Now i send these both to the client. Whenever I make a request to other service, I can only check if the token is valid or not. That was fine until I realized that a user can be banned by admin, and till 5 mins, their token will remain valid. How do I handle this?

0

10.06.2020

2 ответов

3 просмотра

Sharuzzaman Ahmat Raslan

You need to have a blacklist that will be checked against when user connect. That blacklist is controlled by admin. Or have some revocation mechanism that will revoke whatever token you have locally that will be used to verify the authentication

0

10.06.2020

Parra · Accepted Answer

Parra

some people in internet show a way to solve this with a invalidation list, but that makes the jwt almost useless and breaks the design

0

10.06.2020

Похожие чаты

How to I handle user authentication in microservice pattern? I have

2 ответов

Похожие вопросы