I heard that session based authentication are not horizontally scalable. You somehow need a central system which saves the session. Is this same with django's default authentication system?
There are other authentication methods too, like JWT (Which can easily scale horizontally). The problem with JWT is that they have more security risk than a standard authentication system.
Can django's default authentication work without any problem in a multi server setup which has a load balancer distributing the load?
Here's the architecture I mean:
Consider this situation for example:
Let's say we have a loadbalancer distributing the load between 2 servers = ( serverA | serverB ) running our django project.
We have these endpoints in our project:
- '/' - (Home, anyone can access)
- '/login' - (Login Page, anyone can access)
- '/handle-login' - (Login Handler, Endpoint that handles user authentication)
- '/protected-view' - (Protected View, Only authenticated users can access)
A user visits our site (Route = '/', handled by serverA).
Then that user visits the login page (Route = '/login', handled by serverB). Then the user enters his details and authentication process is done (Route = '/handle-login', handled by serverA).
Now the user visits the protected view (Route = '/protected-view', handled by serverB).
What is the expected behaviour? Will the user be able to access the protected view?
Note that the authentication was handled by serverA and the protected view was served by serverB.
