Tokens guda biyu suna nan domin warware sabani kai tsaye: dole ne a aika access token a kan kowace request (don haka yana fuskantar hadari sosai), amma kana kuma son sessions da suke dawwama na dogon lokaci ba tare da tilasta login akai-akai ba. Ba za ka iya samun duka biyu cikin aminci a cikin token guda ba — don haka kana raba aikin.
Authorization header a kan kowace API call. Saboda ana watsa shi koyaushe, leak mai yiwuwa ne; rike shi gajere yana nufin wanda aka sace yana expire kusan nan take.Login ──▶ access (15m) + refresh (30d)
Every API call ──▶ send access
Access expired ──▶ send refresh ──▶ new access (+ rotated refresh)
| Access token guda mai dogon rayuwa | Access + refresh | |
|---|---|---|
| Fuskantar hadari | Ana aika kowace request, yana rayuwa da dadewa → babbar taga sata | Access mai gajeren rayuwa; refresh ana aika da wuya |
| Revocation | Wahala (ba za a iya soke stateless JWT ba) | Revoke refresh token; access yana mutuwa cikin mintuna |
| UX | Sake login akai-akai idan gajere | Yana ci gaba da login ba tare da sake shigar da credentials ba |
| Fadin barnar leak | Babba | Karama (access yana expire da sauri) |
httpOnly cookie, nesa da isar XSS.Wannan shi ne daidaitaccen zamani na auth design, kuma masu tambayoyi suna tambayar sa domin ganin ko ka fahimci dalili, ba wai kawai yadda ba. Muhimmin fahimta shi ne trade-off: statelessness da gajeren fuskantar hadari (access) da dogayen sessions da revocability (refresh). Yin kuskure — access token mai dogon rayuwa, babu rotation, refresh store a cikin localStorage — yana mayar da token guda da ya leak zuwa dogon lokaci na account compromise. Ambaton rabewar da abin da kowane token ke ba ka shi ne abin da ake sa ran injiniya mai sanin tsaro zai sani.
Ɗakin karatu na tambayoyin hira na IT tare da amsoshi cikakke — daga Junior zuwa Senior.
Ba da Gudummawa