Make session stateless (Implement JWT)?

[codihuston]

Ideally such a service would remain stateless. The reason why I didn't want to do this was to secure the google access tokens. If I wanted to go full stateless, I'd need to implement the OAuth v2.0 Authorization Code flow.

Refs: https://auth0.com/docs/flows/concepts/auth-code

[codihuston]

Doing this would prevent the need for an express session, and potentially any other session issues.

Using GraphiQL can present some challenges as discussed here: graphql/graphiql#59 and graphql/graphiql#500

I think, if I went this route, perhaps moving auth behind GraphQL instead of a separate /auth/google route might make this possible; that probably doesn't need to change since you can set HTTP headers in GraphiQL itself.

Just a note... in case I wanted to drop express-sessions altogether. Right now I don't see this being a priority other than wanting the app to be "stateless".

[codihuston]

The sessions are persistent at the moment in effort to secure google access tokens on the server side. These are already stored in the user's table. So, the JWT would simply have a userid, and prior to executing a google query, the api server would need to lookup those keys from there instead of from the active session...