jwt authentication in adonisJs v5

[mayureshnw]

Hi,
Does v5 have support for JWT auth?
If so, could you please point to any documentation or reference.
I could only find web-based and opaque token auth.

Thanks :)

[popovicieduard]

V5 doesn't support JWT by default, but you could create your own implementation. Create Token on login, verify with middleware

[mayureshnw]

I think that's what I'll have to do.
Thanks.

[iammrsea]

See the documentation here

[mayureshnw]

The documentation has Authorization: Bearer token.
I think v4 had JWT support, so I assumed it would be there in v5 as well

[thetutlage]

@mayureshnw What's your use case for using JWT over opaque (or api) tokens?

[Craytor]

@thetutlage not to sidetrack this post, but one benefit of using JWT is the option to 'refresh' tokens that are about to expire. Is there a way to 'refresh' tokens seamlessly like with JWT?

Or, is it possible on client-side by monitoring expiresIn/expiresAt of the token to have the client then request a new token and delete the old token?

[thetutlage]

I believe, refresh tokens aren't required with opaque/api tokens for following reasons.

• The JWT tokens are not in the control of the server.
• As a work-around, people generate JWTs with shorter expiry (in case of breach, they can control the window of damage) and then use refresh tokens to generate a new one.

In case of API tokens, they are completely under your control and having a longer expiry or no expiry is not harmful.

Also, using the token expiry to decide when to generate is new token is not the right approach. I suggest intercepting 401 in your API calls is the best way.

But anyways, if you generate a token with a defined expiry, the result will contain the expiry time as well.

const response = await auth.use('api').attempt(uid, password, {
  expiresIn: '10 days',
})

console.log(response.toJSON())

{
  type: this.type,
  token: this.token,
  expires_at: 'date time',
  expires_in: 'seconds'
}

[Craytor]

@thetutlage thank you for the detailed response.

[woodgates]

@mayureshnw Yo can use Redis to store the logged user auth data for faster response.

[youssefnabil48]

@thetutlage I am implementing an app with microservices and some services rely on adonis.js v5 so JWT is important in that case to avoid duplicating authentication data across the services to keep the services self-dependent or avoid making every service rely on the authentication service

[alex-oliveira]

I did an implementation using adonis guard, which I consider to be the "most correct" way.

#2506 (comment)

[acetex]

Whether it's an opaque token or a JWT token, both are important and useful in different scenarios. People choose to use JWT tokens because they fit better with microservice and serverless architectures, especially if you don't want to manage the token on the server side. Imagine if we used opaque tokens with serverless architecture; whenever we need auth user information or some session data stored, would we have to hit an API endpoint to the service that provides auth user information every time?

Adonis is a very good framework with everything ready to use. However, the major downside is that it still clings to an old-school architecture. It would be great if Adonis were designed to better support microservice and serverless architectures. But I probably won't see that happening, as the direction taken by the framework's developers seems to completely block this possibility.