Contents
Should tokens be stored in DB?
It depends. If you have multiple servers of keep the token between server restarts than you need to persist it somewhere. The database is usually an easy choice. If you have a single server and don’t care that your users have to sign in again after a restart, than you can just keep it in the memory.
Is it safe to store auth token in database?
Don’t Store Tokens in Local Storage; Use Secure Cookies Browser local storage and session storage can be readfrom JavaScript, and as such are not secure to store sensitive information such as tokens. Instead, use secure cookies, the httpOnly flag, and CSRF measures to prevent tokens from being stolen.
Should token be encrypted?
Don’t include sensitive data unless you encrypt the payload As we said above, JWT are not encrypted by default, so care must be taken with the information included inside the token. If you need to include sensitive information inside a token, then encrypted JWT must be used.
Do you need to check for expired access tokens?
You never need to check for expired access tokens or have any state, but limit abuse to the lifetime of the token. If you don’t have the requirement to accept the tokens without checking expiration in a database, you don’t need the two different tokens. You can just use the refresh token for each access. User logs in, gets access and refresh token.
Do you need a database to validate a JWT token?
Unlike the built-in TokenAuthentication scheme, JWT Authentication doesn’t need to use a database to validate a token. Since you are using django-rest-framework-jwt package for the JWT token authentication. You can also use its apis for retrieving or refreshing the token.
What’s the point of having an access token?
The point of having access tokens is that they can be used without checking for invalidation. You can have 10000 frontend servers users can access with the token without the need to ever ask some database if it is invalid. But after some time, the token expires.
Can a refresh token be used as an access token?
The only part which is missing is in how the refresh token is queried – it is implied that the refresh token is considered sufficient to get an access token, rather than the combination of an authenticated session and a refresh token. This is, as you suspect, insecure.