Security 101: Understanding and Comparing Two SSO Methods: Session-Based vs. Token-Based Authentication

Single Sign-On (SSO) is a critical component in modern web applications, allowing users to log in once and access multiple systems without needing to re-authenticate. This blog post explores two popular SSO methods—Session-Based and Token-Based Authentication—and offers guidance on which one is generally recommended.

Session-Based SSO

How It Works

1. User Login: The user logs into the authentication center.

   • 用户登录：用户登录认证中心。

2. Session Creation: A session ID (sid) is generated and stored on the server, linked to the user’s identity.

   • 会话创建：生成会话ID（sid），并将其与用户身份信息一起存储在服务器上。

3. Cookie Storage: The sid is sent back to the user’s browser as a cookie.

   • Cookie存储：会话ID（sid）作为Cookie发送回用户的浏览器。

4. Accessing Subsystems: The user accesses various subsystems by sending the sid, which is validated with the authentication center.

   • 访问子系统：用户通过发送sid访问不同的子系统，认证中心验证其有效性。

Pros and Cons

• Pros: Centralized session management; straightforward implementation.
  • 优点：集中管理会话，易于实现。
• Cons: Requires maintaining server-side sessions; less scalable.
  • 缺点：需要维护服务器端会话，扩展性较差。

Token-Based SSO

How It Works

1. User Login: The user logs into the authentication center.

   • 用户登录：用户登录认证中心。

2. Token Issuance: A token containing encoded user information is generated.

   • 令牌签发：生成包含用户信息的加密令牌。

3. Token Storage: The token is stored in the user’s browser, either in local storage or as a cookie.

   • 令牌存储：令牌存储在用户的浏览器中，可以是本地存储或Cookie。

4. Accessing Subsystems: The token is sent with requests to various subsystems, where it is validated directly.

   • 访问子系统：令牌随请求发送至不同子系统，子系统直接验证令牌。

Pros and Cons

• Pros: Stateless; highly scalable; easily integrates with APIs.
  • 优点：无状态，扩展性强，易于与API集成。
• Cons: Requires secure token storage to prevent misuse.
  • 缺点：需要安全存储令牌以防止滥用。

Which One is Recommended?

Recommendation: For most modern web applications, Token-Based SSO is the preferred choice due to its scalability, stateless nature, and better integration with modern APIs. It is particularly suitable for distributed systems and microservices architecture.

推荐：对于大多数现代Web应用程序，基于令牌的SSO 是更推荐的选择，因为它的扩展性好、无状态，并且更适合与现代API集成。尤其适用于分布式系统和微服务架构。

Conclusion

Both session-based and token-based SSO methods have their use cases, but token-based SSO stands out as a more scalable, secure, and modern approach, making it the ideal choice for today’s complex web environments.

两种SSO方法都有其应用场景，但基于令牌的SSO在扩展性、安全性和现代性方面更具优势，使其成为当今复杂网络环境中的理想选择。