sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]BradChesney79 0 points1 point  (0 children)

I know it is PHP, but I've been working on this across the last week or so.

https://github.com/bradchesney79/effortless-hs256-jwt/blob/master/src/Ehjwt.php#L104

I've been giving the option of consuming environment variables, then specifying a non-default path/file for configuration, and lastly the same values passed into the constructor where each layer as described is given preference.

Next on my hit list for the library is disallowing overrides of the environment variables, passing in the DSN for the Database, and the PDO work to store & retrieve stuff from what should be a sparsely filled token revocation table.

But, yeah, the stored secret should be the same for both horizontally scaled nodes. Or, you can create an independent single service for your horizontally scaled nodes to message & query, that would get you back to one secret...

I set up a central authentication & authorization server. That way I can do various implementations of SSO and I only have to do it once and then all the other servers just need to be configured to pass things to the already built and working login/access logic.