REST API sessionless - Githubissues

krakenjs / lusca

Application security for express apps.

Other

1.78k stars 123 forks source link

REST API sessionless #64

Closed fondberg closed 8 years ago

fondberg commented 8 years ago

Hi,

I got lusca for "free" from a scaffolding tool. Sorry for perhaps asking a very stupid question but is it possible to have a RESTful endpoints which doesn't use cookies for sessions in express?

jasisk commented 8 years ago

Not a stupid question—no worries. :grinning:

Yup, certainly possible. Read up a bit on JWTs. Then, check out the node implementation or the express-specific node implementation (uses the former).

If you want to go whole-hog, this is also precisely what oauth allows for (an ephemeral token used for authentication, etc). JWTs, however, are much more simple and tightly scoped.

Falls a bit outside the scope of lusca so I'm closing this but feel free to continue the conversation.

tlivings commented 8 years ago

Hi - could you give some more details on what you are trying to do? HATEOAS? Simply disabling the session middleware?