security of REST api - token invalidation -
i have rest api serves multiple customers. today, each customer gets own api key sent in headers of each request. api key encrypted string contains data customer, permissions etc. key decrypts api keys same customers, , stored in server. if customer leaves us, want able invalidate token, without invalidating tokens of rest of clients. creates problem. can, example, store each customer's token in customers table, each request api require me run query against customers table, may slow things down. possible store tokens in json file, may faster, don't know. think best solution? btw, i'm not interested in oauth.
Comments
Post a Comment