I'm working on a project which has the following development strategy:

  • Frontend: Angularjs
  • Backend: NodeJs
  • DB: Mysql

I'm bulding a REST system with nodejs and I was wondering how should I handle the user session, exactly? Should I store the tokens in mysql?

Because I'm assuming this will be a delay in processing and performance considering I would have to query the database every time the user makes a request to verify it.

I was folowing this tutorial and they use mongoose to handle the session of the user https://devdactic.com/restful-api-user-authentication-1/ which means hey are using mongodb to handle the session and morphing it into a model 'User'.

Would this be the wisest way to go in my setting? Thank you for your help :)


If you're building a REST system, it is by definition stateless, so session isn't something you directly manage.

Putting that aside for the moment, I'll assume.e you mean just that requests should be authenticated and that you want to know who the user is to authorize whatever action they're taking.

In that case, you have three general approaches to take.

1) keep some form of in-memory session store with a cookie (or other secret, like a URL token) passed to act as the key for the request. This scales poorly, as each worker in your cluster has its own memory space.

2) DB lookup of the user in every request by either passing credentials or (again) some form of session token every time. This has the advantage that all front end nodes of your app can share the DB and they are all up to date on a users rights.

3) Some form of encrypted token that includes whatever user info you need to create the User object. The most common standard for this is the JSON Web Token, but others can work too. This has the advantage of being very scalable and not requiring DB trips on every request, but adds the challenge of token invalidation (eg on logout or when a users rights change).

So all three are fine depending on what you need. Some apps also use a hybrid (eg #2 with #1 as a cache to improve performance), but that will also add complexity and bring along new things to consider (like invalidation of cache items).

Finally, some apps take a heterogeneous approach to the database, using a document store like Mongo for their main business objects and a fast, key-value store like Redis or memcached for stuff that happens every request (like user auth).

| improve this answer | |
  • Hello paul, thanks a lot for your detailed comment! I come from PHP so basically what I'm searching for in nodejs is the equivalent start_session(). Simply storing a cookie on the user side and that identifies his login within every single request. However, if this solution is not viable in nodejs or does not scale well I'm looking for an analogous alternative: the user sends a header with a string token / cookie that I can identify within every request in my server. So I'm in doubt as to wether use a model User or check databases, and if mongodb as a firstline db for auth checking. – Fane May 2 '17 at 19:57
  • The default version would be to just use the Express-session module and setup your Store of choice (cookie, mongo, etc). Again, lots of options beyond that but that's the basic approach. – Paul May 2 '17 at 21:40
  • Hello Paul, thank you for helping me. Would you mind checking my other question related to this? For some reason it is not working and I can't figure out why. Thank you: stackoverflow.com/questions/43822930/… – Fane May 8 '17 at 0:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.