This may edge upon a "best practice" type of question, but I'd like to explain my approach, list out my hypotheses and get constructive feedback.
Currently my setup consists of two servers;
- Node.js frontend server running Sapper/Svelte on
localhost:3000and a - Django (not DjangoRestFramework), backend running on
localhost:8000.
My Django sessions are being cached using django.contrib.sessions.backends.cached_db to a locally running Redis instance (and data forwarded to my Postgres instance).
I am handling my User model using views and urls I've defined in a Django app.
While building authentication; I am following the approach
- Run a
fetch()POST'ing tolocahost:8000/login or signup, using Django'sauthenticate,login, andUser.*to create sessions. - Then I return the
session_keyandemailto the front-end which then sends these in the body for any request which may require authentication. - In the backend, I match the
session_keyto theuser_idusing the e-mail sent to me in the request body to check if the session is valid.
Now since I have always used Django Templating, I hadn't had to ever maintain a separate session instance or had to think about sharing sessions. I feel this approach could be more python-ic?
At this stage, I've also had all the models, migrations done, this approach works, but seems to not be the best way to go about this.
Would appreciate feedback/critique.