Signup Login Flow

Login/Signup flow

Login/Signup is just hashing, we use bcrypt here since it auto include the salt, using bcrypt.compare it auto knows how to separate the salt with the hash

Authentication flow

There are 2 ways, JWT vs Session base

JWT

Once successful login, server set the Session return

1. access_token: Signed by the server using JWT format. Typically valid for 5-15 mins
2. refresh_token: Some random value by the server. Valid for a few days to renew access_token. This one server stores in database for ease of invalidation incase we need to — i.e user logout/reissue new one
   See: Access Token, Refresh token

Server deliver this to the client using Set-Cookie response header. Client will automatically send these header in subsequent requests

The JWT will contains the client's user detail. This JWT can be send to authenticate cross microservice. Other microservice verify this using server public key the access_token

If need to send access_token via Http Authentication Bearer header, consider using BFF

BFF (Backend-for-frontend) allow us to talk to our own backend using HttpOnly Cookie without exposing the access_token via Authentication

Token renewal

Once access_token expire, client hit POST /v1/auth/refresh with raw refresh token via Cookie. Server will hash it and check it with the database

Once good, server replace old refresh_token with new refresh_token, send the client back access_token, refresh_token

Session base authentication

In here we just Set-Cookie the Session Id on the client, the client can then use this sessionId as HttpOnly Cookie to authentication betwen different Microservices

However, these microservicees need to check Database or Redis for user_id, session_info, scope, …

Why JWT better for microservice

JWT already contains user_id, scope and the necessary information. No need to store in centralise db.