Developer overview
Statusneeds_info
BlockingISS-001
Next actionChoose one option
OwnerBackend Team
- Need to decide authentication method before implementing API endpoints
- JWT offers stateless scalability, Session offers simpler revocation
- Decision affects database schema, middleware, and client implementation
Before / after
Before (No auth)
All API endpoints public, no user identity, no access control
After (With auth)
Protected endpoints, user sessions, role-based access control
Options or states
Recommended
Option A — JWT (JSON Web Tokens)
Stateless authentication
Token: {user_id, role, exp}
Stored: Client-side (localStorage/cookie)
Benefits: Scalable, no server state, works well for microservices
Limitations: Can't revoke tokens easily, larger payload size
Risk: Token theft = account compromise until expiry
Option B — Session-based
Stateful authentication
Session ID: uuid-v4
Stored: Server-side (Redis/DB) + cookie
Benefits: Easy revocation, smaller cookies, better security control
Limitations: Requires server state, harder to scale horizontally
Risk: Session store becomes single point of failure
Option C — OAuth 2.0 + OpenID Connect
Delegated authentication
Provider: Google/GitHub/Auth0
Flow: Authorization Code + PKCE
Benefits: No password management, social login, enterprise-ready
Limitations: External dependency, complex implementation, UX friction
Risk: Provider downtime = login unavailable
Saved with the choice when served via session-serve.
Decision comparison
| Criterion |
JWT |
Session |
OAuth |
| Scalability |
Excellent |
Good |
Excellent |
| Implementation complexity |
Low |
Low |
High |
| Revocation capability |
Poor |
Excellent |
Excellent |
| Security control |
Medium |
High |
High |
| Development time |
1 day |
1 day |
3-5 days |
Decision requested
Confirm which authentication method to implement for the API. This decision affects:
- Database schema (users table, sessions table)
- Middleware implementation (auth validation)
- Client-side storage strategy
- Logout and session management
View statically via CDN, or serve with python tools/session-serve/serve.py <session> to record the choice.