CODEWITHSUNDEEP
securityoauthjwtgraphqlopenid-connect
zefciu
zefciu

Reputation: 2047

Correct strategy for auth in an API

I want to design a GraphQL API. This API would be used by some browser apps and also open to be used directly for people that want to create their own scripts/generate reports etc. The API would rely on a third party app supporting Oauth Openid Connect (okta) for user and role management. It would be written in Django.

Because JWT is a recommended way of protecting GraphQL APIs and also because OIDC uses JWT tokens. I thought of a simple way, where the API would simply accept the JWT tokens issued by okta. This works, but I see a lot of latency when API is asking okta validate the token (this latency might be smaller in production, because I'm testing on a free trial auth0 instead of production okta). So I think that maybe my API should issue its own JWT tokens. I can think of three strategies here:

  1. Leave it as is – only use the OIDC JWTs.
  2. Introduce a login mutation or a login REST endpoint, that would accept OIDC above and issue JWTs that can be used for all other operations.
  3. As above, but also allow the direct use of okta's JWTs (I'm not sure if I can implement it with Django's auth system, so that if a token is recognised, the OIDC is not called).

Which of these three is the correct (and maybe intended by the OIDC designers) way to protect my API?

Upvotes: 0

Views: 414

Answers (1)

Jan Garaj
Jan Garaj

Reputation: 28724

JWT token doesn't need to be validated by Okta (generally by IdP). You just need to get used public key (it can be found as jwks url in discovery response) and then can you can verify signatures without any IdP call.

IMHO you can get 2-4k validations/sec easily.

Upvotes: 1

Related Questions