I want to call my REST API with encrypted SMS(with some intermediate server and a shared key by client and server which is transmitted via SSL), I have problem with sending requests that need authentication, When user have internet connection, JWT tokens are sent and everything is good, But if I want to call the same method with SMS, Sending JWT token makes my request very long which is not acceptable for me.
I was wondering instead of JWT tokens, I store information inside token into a table named
token and only send encrypted
id of that table to mobile client and since the id is much smaller than token, It satisfies my requirement.
I was wondering what is drawback of this approach? I mean instead of sending a signed token, I send an encrypted
id to client. All the information about token(userId, timeStamp, clientIP, user mobile number ...) are stored in a table named
Tokens which has foreign key to signed in user.
Replay attacks, Stolen token I guess are handled by client IP or mobile number, What else do you think?
Another point I want to add is that my server is only used by a web client and a mobile app and nothing more !