Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a Single Page Application (SPA) that communicates with an API. I've created a very simple authentication system: user logs in and gets a JSON Web Token (JWT) that's stored on user's local storage.
I also have an endpoint on the API that let's me check if the token is still valid or not.
Should I call this endpoint each time a user navigates to a different page on the SPA or should I only call it when the user wants to access areas of the site that will use the token for requests?
This depends.
If you need the token for authentication and unauthenticated users are not allowed to access anything, you should check its validity for every request.
If you only check the token when you need a part of the information from it - and are fine with anonymous access to all other sites, you don’t need to check it on every request.
Please note that it‘s easy to forget to check the token when you need no information from it yet want to restrict access for logged in users, thus checking the token all the time seems like a good idea, especially since you seem to imply that every request should have a token.
I second @SmokeDispenser's answer.
You haven't told us what content you are putting into the JWN, but in general a JWT provides two things:
Proof that this is an authentic, logged-in user.
Contains information used to enforce Access Control List (ACL) rules, ie being able to ask "Is this user allowed to view / modify this resource?".
So I would flip the question around and ask for each API or type of request:
Does the server need to know the identity of the user in order to handle this request?
For an API call that's fully public (no authentication required), then No, you have no reason to check the JWT.
For all other cases, you should be returning 403 Forbidden if someone who is not logged in tries to access it. So Yes, you need to check the JWT with each request; at the minimum that the JWT has not expired, and possibly also that this user has permission to access this resource.
