5

I have a Single Page Application (SPA) that communicates with an API. I've created a very simple authentication system: user logs in and gets a JSON Web Token (JWT) that's stored on user's local storage.

I also have an endpoint on the API that let's me check if the token is still valid or not.

Should I call this endpoint each time a user navigates to a different page on the SPA or should I only call it when the user wants to access areas of the site that will use the token for requests?

Improve this question
3
  • Can you define SPA? Trying to google it is hopeless: Share Purchase Agreement? Software Process Assessment? Software Product Assurance?
    – Mike Ounsworth
    Nov 25, 2017 at 19:14
  • @MikeOunsworth Single Page Application (mine is an Angular project).
    – Ivan Aguilar
    Nov 25, 2017 at 20:16
  • You should make it so that the extra endpoint is unnecessary. When a user tries to access some resource that requires a valid JWT, you simply return 403 Forbidden and let the app handle the re-authentication. Making an extra API call that is redundant really slows things down on slower connections.
    – Martijn
    Nov 25, 2017 at 23:43

2 Answers 2

Reset to default
2

This depends.

If you need the token for authentication and unauthenticated users are not allowed to access anything, you should check its validity for every request.

If you only check the token when you need a part of the information from it - and are fine with anonymous access to all other sites, you don’t need to check it on every request.

Please note that it‘s easy to forget to check the token when you need no information from it yet want to restrict access for logged in users, thus checking the token all the time seems like a good idea, especially since you seem to imply that every request should have a token.

Improve this answer
0

I second @SmokeDispenser's answer.

You haven't told us what content you are putting into the JWN, but in general a JWT provides two things:

  1. Proof that this is an authentic, logged-in user.

  2. Contains information used to enforce Access Control List (ACL) rules, ie being able to ask "Is this user allowed to view / modify this resource?".

So I would flip the question around and ask for each API or type of request:

Does the server need to know the identity of the user in order to handle this request?

For an API call that's fully public (no authentication required), then No, you have no reason to check the JWT.

For all other cases, you should be returning 403 Forbidden if someone who is not logged in tries to access it. So Yes, you need to check the JWT with each request; at the minimum that the JWT has not expired, and possibly also that this user has permission to access this resource.

Improve this answer
2
  • I should've explained myself better, all the API endpoints require the token, and they do return a 403 when unauthorized. My question was more about letting users navigate to protected pages on a web application.
    – Ivan Aguilar
    Nov 25, 2017 at 20:20
  • Shouldn’t a not logged in user get authentication required and a logged in but unauthorized user unauthorized?;)
    – Tobi Nary
    Sep 3, 2019 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .