does Token Based Authentication requires to store token in DB?

Question

I am using token based approach in authentication, but in many blogs i read that they are storing token in the database.

Do we need to store token in Token Based Authentication in DB?

https://scotch.io/tutorials/the-ins-and-outs-of-token-based-authentication

In this blog, it is mentioned that we are signing the tokens instead of storing in database, and i think this should be the way to go to acheive true statelessness.

Answer 1

If you are using a Token base Authentication as described in the linked/mentioned web page there is no necessarity to store the token in a database.

What you have to consider is it possible to transport all required infomation the resource servers need to fullfill deliver the requested resources within the token in a secure way.

To transport for example the userId in a secure way you can additionally encrypt the token. If you want to ensure some data never leaves your datacenter for security reasons than it would be a good idea to hold those data in a database and the token only contains a reference(id) to the user related data stored in a database - that's more or less what's described in Open ID connect.

You should also keep in mind that adding user information to the token means addional payload with each request and may take longer to encypt / decrypt and sign / verify the signature.

If you are going to use the stateless / database less aproach you should clarify:

• the possible size of the token
• the additional cpu load to sign / verify / encrypt / decrypt the token
• header size limitations
• distribution of the keys used to sign / verify / encrpyt / decrypt the token within your datacenter
• extending the lifetime of the token
• revokation of the tokens
• additional security requirements - i.e. is it a problem if an attacker is able to read / (decrypt the encrypted) token?

Answer 2

It depends. If you have multiple servers of keep the token between server restarts than you need to persist it somewhere. The database is usually an easy choice. If you have a single server and don't care that your users have to sign in again after a restart, than you can just keep it in the memory.