共享用户数据库的双应用单点登录及跨应用保持登录方案咨询

Absolutely, this is totally achievable—what you're looking for is Single Sign-On (SSO) tailored to your shared database setup. Let's break down the most practical, straightforward solutions that fit your scenario:

1. Shared Session Storage Approach #

Since both apps connect to the same database, you can centralize session management to sync login states:

• When a user logs into App A, generate a cryptographically signed session token (like a JWT or a unique session ID) and store it in a shared session store—this could be a dedicated sessions table in your shared database, or a distributed cache like Redis.
• Configure both apps to use the same session validation logic: When a user opens App B, it first checks for a local session. If none exists, it queries the shared session store for any valid sessions linked to the user's identity (you can detect the user via a shared identifier like email or user ID, maybe from a cached cookie hint).
• If a valid session exists, App B automatically creates a local session for the user, skipping the login prompt.
• Pro tip: Use JWT with a shared secret key across both apps—this lets you validate tokens without hitting the database every time, while keeping things secure. Example JWT payload (simplified):

  {
    "user_id": 123,
    "exp": 1717245600,
    "iss": "your_shared_domain"
  }
  

2. Shared Cookie (Same Root Domain) #

If both apps live under the same root domain (e.g., app1.yourcompany.com and app2.yourcompany.com), cookie sharing is a simple, low-overhead option:

• When App A authenticates the user, set a cookie with the domain attribute set to .yourcompany.com (the leading dot makes it accessible to all subdomains). Include an encrypted token (JWT works great here) with user details and expiration.
• Make sure to set secure cookie flags: HttpOnly (prevents XSS access), Secure (only sent over HTTPS), and SameSite=Strict or Lax (reduces CSRF risk).
• When the user navigates to App B, it will automatically receive this shared cookie. App B validates the token's signature and expiration, then creates a local session to log the user in automatically.

3. Database-Direct Login State Sync #

For simpler setups where you don't want to add external tools like Redis, you can leverage your shared database directly:

• Add a active_sessions table to your shared DB with fields: user_id, session_token, expires_at, app_id (optional, if you want to track which apps the user is logged into).
• On App A login, insert a new record into this table with the user's ID and a signed token.
• When App B loads, check if the user has any non-expired records in active_sessions. If yes, validate the token and create a local session for auto-login.
• Don't forget to implement a cleanup job (like a cron task) to delete expired session records to keep your DB lean.

Critical Security Notes #

• Always encrypt sensitive user data in tokens and database records—never store plaintext passwords or unhashed user IDs.
• Implement cross-app logout: When a user logs out from one app, delete the shared session record or invalidate the token so the other app also logs them out automatically.
• If your apps are on completely separate domains (no shared root domain), avoid cookie sharing—stick to the shared session store or JWT approach instead. For more complex setups, you could also implement OAuth2.0/OpenID Connect, but that's overkill for a simple shared DB scenario.

Any of these approaches should work smoothly for your setup. Pick the one that aligns best with your tech stack—most frameworks (React, Spring Boot, Node.js, etc.) have built-in libraries or plugins to simplify SSO implementation!

内容的提问来源于stack exchange，提问作者Ion Verdes