I know there are many similar questions, but I've still couldn't find answers to my questions.
@UseGuards(JwtAuthGuard)
public async create(
@Req() request: RequestWithUserModel,
@Body() createUserEnterpriseDto: CreateUserEnterpriseDto,
): Promise<UserEnterpriseEntity> {
return await this.userEnterpriseService.create(
request.user,
createUserEnterpriseDto,
);
}
And I get user in my @UseGuards(). But If I'm going to use such approach to each endpoint it will create pressure to db, doesn't it? If so, are there the best ways to deal with it?
Thank you for answers!
If you are implementing OAuth yourself, then yes you have to store refresh token in you db. I would recommend using identity provider implementation like Auth0 instead of reinventing the wheel.
Yes redis is a great choice for designing your auth service. This article does a good job in explaining the why aspect of it. https://redis.com/blog/json-web-tokens-jwt-are-dangerous-for-user-sessions/
JWT is essentially a stateless way of authorization. Once your identity provider has issued a JWT, all that is needed for any authorised api is to test the validity of JWT. This means ensuring that JWT is not expired and is valid and has necessary roles. Validating against db for all authorised api's beats the purpose of a jwt
Hope this helps