I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway.

Knowing there is no solution for session when using lambdas, I was wondering if I could only use the id_token provided by the Google JavaScript library to authenticate a user?

The idea is to pass the token for each request to the back-end and make a request to Google to know if the token is legit.

Does this sound like a secure solution?

  • What makes you say there is no solution for sessions when using lambdas? What do your lambdas do? Do they connect to a database? If so, you could store session information in there. Checking the id_tokens everytime would be secure, but it'd impose a lot of latency – Jenessa Aug 18 '19 at 10:05
  • I didn't find any solution, other than hand made. They connect to DynamoDB. Each time the lambdas are invoked, they call google API to verify the token. – Kaymaz Aug 18 '19 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.