reactjs - What is the correct way to implement a stateless authentication? -
i new single page application. 1 big question me how make application secured. using react in front-end , express + mongodb in back-end.
i old web site, use session authorization. if session timeout, can let user redirect login page. , if user keep actions on our website, session never expired.
but now, using jwt authorization. token may expired in 1 minuet, after that, user have login again.
for understanding, 1 way 're-send token on every request/response, each request/response have new token'. think not correct way of how use jwt.
so questions are:
- what correct way avoid user login again if still work on our web app?
- do need store token in database (mongodb)?
- if store token in localstorage, can borrow browser , copy token client. how avoid it?
Comments
Post a Comment