Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

authentication token cache for azure function

We use an Identity server to issue tokens for 3rd party service we use.

Each token have TTL of 1 hour. Wanted to know what is the best practice for caching this token when consuming it from an azure function. I know that function should be stateless but it's makes no sense to ask for a new token in every function run. Thanks.

like image 736
Rotem Slootzky Avatar asked Apr 18 '17 13:04

Rotem Slootzky


People also ask

Does Azure function cache?

The Azure App Service Local Cache feature provides a web role view of your content. This content is a write-but-discard cache of your storage content that is created asynchronously on-site startup. When the cache is ready, the site is switched to run against the cached content.

Where should authentication tokens be stored?

If any of the third-party scripts you include in your page is compromised, it can access all your users' tokens. To keep them secure, you should always store JWTs inside an httpOnly cookie. This is a special kind of cookie that's only sent in HTTP requests to the server.

What is cache token?

Our CACHE Gold Token (CGT) transparently combines the unique qualities of gold with the benefits of a modern crypto asset. Fully backed, redeemable, regulated and with worldwide liquidity, one CGT represents one gram of pure gold.


1 Answers

Here a few options, in increasing order of effort

  1. Use a static member to store the token in memory, and lazily do the authentication process when necessary. There are absolutely no guarantees about how often this will save you the authentication step - it will vary wildly depending on how often your function is running, on how many different machines, etc.

  2. Make use of the temporary filesystem storage provided to functions. You can read/write files on %TEMP%.

  3. Use a persistent external store such as a database, redis cache, etc.

Please note that I'm listing these options without considering whether you have additional security requirements regarding the persistence of the token.

like image 134
Paul Batum Avatar answered Oct 13 '22 02:10

Paul Batum