Session management and JWTs

We looked at session management using cookies previously in Chapter 6, Moving to API-First, using the Gorilla Mux middleware. In our app, we created an in-memory cookie store via the functionality provided by Gorilla sessions: https://github.com/gorilla/sessions.

We previously implemented our middleware to validate that our user was approved by encoding two values – a user ID we looked up from the database and a userAuthenticated Boolean value. This worked well for our use case, but our implementation meant that every call to our API backend required a round trip to the database to check that the user ID was still present, before letting the call continue.

Figure 10.1: An illustration of login and save API workflows using a session cookie

This approach is fine and the Gorilla sessions library provides a number of alternative backends to speed things up, such as using Redis and SQLite, but we’re going to look...