I'm developing a CLI based application. It has a "login" command to perform authentication:

$ myapp login 
$ Type username: hector
$ Type password: *****
$ Login success!

Internally, myapp login makes a request against a HTTP API and a authentication token (JWT) is returned, so I need to keep it in the client somehow, in order to send it in subsequent requests.

Should I store this token in disk? Or maybe keeping it in memory and make the session 'volatile'? Is there any pattern or well-known practice for this?


I found an answer here: https://stackoverflow.com/questions/9146217/how-does-heroku-store-its-authentication-on-its-command-line-app

It has a Heroku's site link and explains very well how they face this. Basically, they store authentication token in ~/.netrc file.

  • 1
    Key word is token. The value in password should be a one-way hash, preferably salted, etc. Bottom line is that if two people have the same password it shouldn't look like it in the .netrc file. Hopefully the ruby gem the Heroku team created will handle that detail for you. If not, be aware. – Berin Loritsch Jun 26 '18 at 17:41
  • 3
    Storing contexts and sessions in hiden files and folders is quite common. In my recently experience with CLIs for cloud platform such as OpenShift, Azure and Bluemix I have realised that they, in essence, do the very same. Storing tokens in files is fairly common. One important thing to be aware of is the token expiracy. The use to be short-living tokens with no refresh tokens. Remember also the concurrency. Several processes reading-writing the same file might lead you to unexpected security issues. – Laiv Jun 27 '18 at 21:41
  • 1
    And this is essentially the same as what happens when you log in to a website - the browser stores a cookie on disk, which acts as a token for access to your logged in session. – bdsl Aug 26 '18 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.