How to create a Django REST JWT authentication scale with mulitple web servers?

Question

I currently have a Django application, which is just a set of REST APIs (with database support, of course). I manage my authentications using the Django REST framework JWT . It works great. Whenever a user logs in, one of my APIs returns a token that the consumer application stores for later use. So far so good.

However, in the future this solution will need to be scaled. And instead of having one server running the Django application, I can anticipate a situation where I need several Webservers. Of course, all these web servers will be connected to the same database. But since the token is not stored in the database, how will it work with multiple web servers? The token issued by one server will not be valid for another.

So how did other people solve this problem?

Answer 1

In short, you need NOT worry about scaling with JWT

Detailed explanation:

First, consider the difference in implementation between the default token authentication provided by Django-Rest-Framework (DRF) and the token provided by DRF-JWT

Token provided by DRF

rest_framework.authentication.TokenAuthentication

Token creation:

1) Create a token

Token.objects.create (user = user)

2) Store the token created in step 1 in the database

3) Return the token to the client

Token Identification:

1) Check if the token exists in the client in the database

2) If a token exists, it means that the user is authenticated

Token provided by DRF-JWT

rest_framework_jwt.authentication.JSONWebTokenAuthentication

Token creation:

1) Create a token

body = base64encode (header) + "." + base64encode (payload)

signature = HMACSHA256_encode (body, 'secret_key') #secret key is usually specified in your .py settings

token = body + "." + signature

2) Return the token to the client

Token Identification:

1) Decode a token

token_segment = token.split ('.')

body = token_segment [0] + "." + token_segment [1]

signature = token_segment [2]

decode_body = HMACSHA256_decode (signature, 'secret_key')

2) If decode_body is equal to the body, the user is authenticated

Conclusion

From the above mechanism, we can safely conclude that the JWT approach is more scalable, since it depends solely on secret_key, and each web server should have a secret_key in settings.py

To answer your question, you do not need to worry about scaling it :)

Answer 2

Depending on how often you think the database will be deleted. My first instinct would be to cache the token and use memcached for this. Django has good support for this. If you use a cloud platform such as GAE / Python or AWS, everything is a little different (in terms of configuration), but solutions exist for both and are not very difficult.