I have a use case like this and I am wondering if this solution is a good practice or not.
Say I have a website called
dashboard.com and this is only for
US region. When users login here, I am storing their session into
USRedis instance. However this dashboard has two buttons named
Assume that this is the UI for
dashboard.com (pardon for text based UI). The doted elements indicate html buttons. So I have two buttons named
http://www.dashboard.com ---------- ---------- |USWebApp| |EUWebApp| ---------- ----------
Once user is logged into
dashboard.com and clicks
USWebApp, I pass the session cookie to
USRedis to validate the session. If session is not valid, then we redirect the user back to
dashboard.com (and user logs in again by typing credentials).
On the contrary, user can click
EUWebApp. Again I am passing
dashboard.com's session cookie to
EURedis to validate this session. However when user logged into
dashboard.com I only persisted their session to
USRedis. So when
EUWebApp tries to validate this session by looking in
EURedis, it won't find the session since I never wrote to
EURedis when user logged into
dashboard.com (main site) in the first place to begin with.
Two solutions that I can think to solve this
EUWebApp should talk to only
USRedis, to validate the session instead of talking to
2) when user logs into
dashboard.com I should store their session in both
USWebApp can use
EUWebApp can use
EURedis to validate the user session.
What do you guys think about this? Especially the 2nd approach? Is that a good practice?
Apart from these two approaches, do you know any other solutions for my architecture?
More information in case interested: (not really needed for this question) I am building a main site and integrating with a SAML IDP(Identity provider). Think of dashboard.com as your company's main page where you have access to multiple apps like word, splunk, teams, etc.