For my recent project I decided to leverage Authentication-as-a-Service, in particular I am using Auth0 but I do not think this particularly matters. I've got my React client set up correctly and I am capable of signing in, I can also make authorized, restricted calls to my backend API (written in ASP.NET Core.)
The examples ends here and I am not certain how to continue. My application is very social and relies heavily on relational data between users and their content. Among my most commonly retrieved data would be user profiles, like avatars and display names.
I cannot figure out for the life of me, how I am meant to get at this data. Imagine a comment thread, I want to display the avatar and name of each poster along with their posts. Storing the posts on my data is simple, I can simply use the
sub claim of the JWT for that. What is less obvious to me is where I would store my user profile, I see the following options:
- I could use Auth0's management API, but this is heavily rate limited (I mean VERY heavily rate limited), and seems more meant for creating users and administrative tasks.
- I could keep a 'local' user profile in my own database, but at that point I am starting to wonder why I would ever use Auth0 at all.
What options are there for tackling this kind of specific problem?