I have a web game design question. I am trying to build a multiplayer web game with non intensive graphics (ex tic tac toe, chess). I am trying to figure out how to take already authenticated users in the website (Django auth) and authenticate them to a java game server where they will be able to talk and receive updates to the java game server using a socket connection.

My initial plan was this:

  • Authenticated client sends their username and website session id to the java game server.
  • the game server checks that client session id with the Django server to ensure the user is who they say they are
  • If Django server approves, then game server will send a new temporary token for the client to present to the game server whenever it wants to send information.

I am not sure if this is a good strategy, especially since it deals with passing around session ids. If you have any advice on how I could go forward with this let me hear it!

Thank you in advance!

1 Answer 1


This is one of the problems that JSON Web Tokens can solve. A JSON Web Token, often abbreviated as JWT, combines information about the user in the form of claims and the roles they have in the system describing what the user can do. A claim can be something like the username, an email address, user ID, etc. Tokens are encrypted when sent to the client. The client typically includes the encrypted JWT as a bearer token in an HTTP header. The server then decrypts the token and reads the claims and roles before executing the request.

Most programming languages have libraries to generate, encrypt, and decrypt JWTs, so this can be used across Python and Java (and much more).

Upon authenticating in the Django app, the server responds with a JWT, which the client needs to store for its own use. The client sends this JWT as the bearer token to the Java app in subsequent requests.

The specifics of how to implement this with your application are beyond the scope of this question, but this should give you enough information to begin researching how to do this.

A word of warning though. Many of the resources about JWTs refer to OAuth, OpenID Connect, and other forms of federated authentication. This is not strictly necessary, unless you want to support logging in via popular social networks or other services offering user authentication. If your Django application already authenticates users, it can generate it's own JWT to keep things simpler to start.

  • Thank you for your answer. I did want to ask, what would the implications on speed be if I have to encrypt communications between a game server and potentially many different clients? Commented May 24 at 6:18
  • @Mr.Octodood, JWTs are encrypted once but decrypted many times. This is pretty efficient business anymore. In fact, many would argue all communication between client and server should be encrypted for privacy and security reasons. Cyber security is a deep topic. Commented May 24 at 11:19
  • Okay makes sense! Commented May 25 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.