Is it best practice to use sessions? about active-directory-javascript-nodejs-webapi-v2

[derisen]

Oh I understand your concern, but I wouldn't worry about it: Azure AD handles around a few billion requests everyday! Now how it deals with such scales is beyond me of course, but I would recommend checking out this blog post.

[derisen]

@DarkLite1 as far as I know, the best practice for RESTful APIs is to be stateless i.e. each request should contain all the information that the API needs to decide whether and how to respond. As such, sessions are not recommended for REST APIs, in particular with respect to scalability (e.g. your API should be able to handle requests from any client type, some of which might not be able to establish a session). Of course, this might be in conflict with your performance needs. In that case, perhaps you should reconsider your app topology -a web application, instead of SPA + web API, might be the better approach for you.

[DarkLite1]

Thank you for the clarification @derisen . For me personally it would be a lot easier to not be using sessions, setting up cookies, maintaining the session store, ... . But, when using a session on the backend and having a login graphql mutation called by the client only once, than Azure AD will also be called only once to verify the token and from that point on a session would be started to avoid calling Azure AD multiple times to verify the token.

Verifying the token with passport.authenticate() and session: false for every call is fine by me. I'm just wondering at which point Azure AD will say "Hey man, you're sending us too many verification requests, we're baling out!".

Could you elaborate a bit on this? How will Azure handle so many requests?

[DarkLite1]

Awesome! Going for a stateless API simplifies the design a lot! Thank you very much for the information. Closing this one.