protecting endpoints
Unanswered
<ragewire/> posted this in #help-forum
I have a endpoint for example /user/tutorial/complete and it basically gets hot and updates a Boolean in the database stating you completed that tutorial. My question is should I verify the user even though it’s not a important endpoint
14 Replies
@alfon Yeah why not
Extra Database calls
@<ragewire/> Extra Database calls
Does the user have to be authenticated?
@<ragewire/> Yes
Using jwt or db sessions?
@alfon Using jwt or db sessions?
Jwt but still logged in db so I can invalidate them if user logouts or resets password
@alfon this is how it works
A jwt token is created and then a token is saved in the db and then if the jwt is invalid or there is none in the db it’s rejected
@<ragewire/> Jwt but still logged in db so I can invalidate them if user logouts or resets password
Well then you can just check for the jwt token then you wouldnt need to call db to authenticate it right?
@alfon Well then you can just check for the jwt token then you wouldnt need to call db to authenticate it right?
No because I want it where if a user logouts or resets the password that jwt token is invalid
And only way to do that is to still have database checks
Since if not hacker will have access to the token in tell it expires
@alfon
Maine Coon
@<ragewire/> this might help https://stackoverflow.com/questions/61437313/what-is-the-standard-practice-to-store-jwt-tokens-in-redis