I have a question about what's the best approach to handle persistent data for web apps.
I have a web app that is authenticating through an auth service. once authenticated it makes requests to the resource server.
However, when a user logs in, they want the display settings of the web app to be consistent regardless of the session or what browser they use.
There will be a lot of user settings but for the sequence diagram let's just say there is one, Dark mode.
Would it be better to keep user settings as claims in the ID token or would it be better to keep user settings inside a database in the backend?
For both cases the initial returned settings would be
And the updated setting would look like
The only difference is for case number 1 the settings would be inside the ID token JWT payload and for case 2 it would simply be a JSON response.
- We don't use the same auth service for all of our environments. we use keycloak in some cases and auth0 in others.
- there will be lots of settings not just dark mode.