search

magento / architecture

A place where Magento architectural discussions happen
275 stars 155 forks source link

Stateless tokens #320

Closed AlexMaxHorkun closed 3 years ago

AlexMaxHorkun commented 4 years ago

Problem

Admin/customers API tokens are stored in DB thus forcing Magento to contact storage during authentication which is avoidable, requiring additional cron job for clean up, need extra protection

Solution

Encode information required for authentication into tokens themselves, do not store them

Requested Reviewers

@paliarush

joni-jones commented 4 years ago

This proposal extends a list of scenarios to be supported by introducing JWT https://github.com/magento/architecture/pull/188.

AlexMaxHorkun commented 3 years ago

Will be implemented by our team