In a new project, we try to clarify how authorization should look like. I've been reading up on this for days, but it's not really clear to me which solution would be the right one to use. Some solutions are not recommended anymore, some solutions will not work in the future.

Project-related info:

  • The backend is PHP/MySQL.
  • There are multiple frontend client types planned:
    • SPA website using ReactJS
    • Browser extension using ReactJS (SPA)
    • Desktop app using Electron and ReactJS. (Also a SPA)
    • Mobile app using React Native
  • Communication with REST APIs
  • The system handles tasks, inventories, wikis, documents only. So no critical finance or health information.
  • Users register/login with username and password.
  • In a typical use-case the users do an action every 1-2 hours. (So a typical 30min server-side user session expires between usages)
  • The user can use multiple clients parallel. So make some actions on the website, then later some on his/her mobile.
  • The goal is to avoid username/password logins every time a user does an action. Login once every 2-4weeks is acceptable.
  • We don’t have a dedicated authorization server. The resource server and authorization server would be the same PHP backend on the same domain/server.

Here is my research summary:

Am I right in thinking that - now in 2021 - a refresh token rotation solution would be best? It seems to be even a bit easier to implement. Or am I missing something or confusing something?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.