The best way to manage refresh tokens server-side

KunAguero 0
Viewed 33

I am using redis to store it in userId:refreshToken.

However, this method prevents one user from logging into multiple devices.

So I try to change it to the format of userId_accessToken:refreshToken.

However, this method should be del->insert whenever the access token or refresh token is changed.

So I'm debating between two methods.

  1. Save it in redis as above.
  2. Save in DB as [id, userId, refreshToken, accessToken, expDate].

In mysql, I will create a cron that will delete it after the expDate. In redis, It will apply ttl when creating it. What's a better way?

Our server's memory is 3969424. Database uses rds and mysql.

If there's another good way, that's great too!

redis jwt mysql token
1 Answers

I would choose whichever is simpler to implement

and another thought, you can use MyRocks engine to automatic delete old keys

MyRocks-ttl

CREATE TABLE t1 (a INT, b INT, c INT, PRIMARY KEY (a), KEY(b)) ENGINE=ROCKSDB COMMENT "ttl_duration=3600;";

In the above examples, we set ttl_duration to 3600 meaning that we expect rows older than 3600 seconds to be removed from the database.

wu hoyt0
Related