justin90lawrencegx1
11/12/2022, 11:46 PMrecipe/session/verify
. And looked into the source code, noticed it does few things:
- Get access token from the session
- Get config about whether checking blacklist from DB query.
- Seems if the above config is false, it will do some DB transaction to update information inside session.
Here are the source code I read:
- Verify session API: https://github.com/supertokens/supertokens-core/blob/master/src/main/java/io/supertokens/webserver/api/session/VerifySessionAPI.java#L69
- Get session called inside the verify session API: https://github.com/supertokens/supertokens-core/blob/master/src/main/java/io/supertokens/session/Session.java#L142
Hence, looks like it's not a stateless check (like Auth0, just validating the JWT token has expired or not). So I am bit concern about the performance because looks like it's the recommend way in the doc for APIs required user to be logged in: https://supertokens.com/docs/thirdpartyemailpassword/common-customizations/sessions/session-verification-in-api/verify-session
The reason of having the concern is the nature of the business, which is selling hype ecommerce products. So the first 10-15 minutes, it would be a lot requests hitting our platform.
Please correct me if I am wrong here 🙏SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).
Powered by