Best way to approach connection between game server to client connection with Django web server as middleman

Question

I have a web game design question. I am trying to build a multiplayer web game with non-intensive graphics (ex tic-tac-toe, chess). I am trying to figure out how to take already authenticated users in the website (Django auth) and authenticate them to a java game server where they will be able to talk and receive updates to the java game server using a socket connection.

My initial plan was this:

• Authenticated client sends their username and website session ID to the java game server.
• the game server checks that client session ID with the Django server to ensure the user is who they say they are
• If Django server approves, then the game server will send a new temporary token for the client to present to the game server whenever it wants to send information.

I am not sure if this is a good strategy, especially since it deals with passing around session IDs. If you have any advice on how I could go forward with this, let me hear it!

Answer 1

This is one of the problems that JSON Web Tokens can solve. A JSON Web Token, often abbreviated as JWT, combines information about the user in the form of claims and the roles they have in the system describing what the user can do. A claim can be something like the username, an email address, user ID, etc. Tokens are encrypted when sent to the client. The client typically includes the encrypted JWT as a bearer token in an HTTP header. The server then decrypts the token and reads the claims and roles before executing the request.

Most programming languages have libraries to generate, encrypt, and decrypt JWTs, so this can be used across Python and Java (and much more).

Upon authenticating in the Django app, the server responds with a JWT, which the client needs to store for its own use. The client sends this JWT as the bearer token to the Java app in subsequent requests.

The specifics of how to implement this with your application are beyond the scope of this question, but this should give you enough information to begin researching how to do this.

A word of warning though. Many of the resources about JWTs refer to OAuth, OpenID Connect, and other forms of federated authentication. This is not strictly necessary, unless you want to support logging in via popular social networks or other services offering user authentication. If your Django application already authenticates users, it can generate it's own JWT to keep things simpler to start.