基于HTTP2会话替代逐请求认证的可行性与实现方案问询

Great question! HTTP/2's persistent connections open up interesting optimization opportunities for authentication, but there are tradeoffs to consider. Let's dive into your questions one by one:

Is This a Good Practice? #

It depends on your use case—here's the breakdown of pros and cons:

Pros #

• Performance Boost: Skipping per-request JWT parsing/validation cuts down CPU overhead on your load balancer and backend services, especially in high-concurrency scenarios. HTTP/2's connection persistence means you can amortize the cost of authentication across multiple requests in the same session.
• Simpler Client Logic: Clients don't need to attach the JWT to every single request once the session is authenticated, reducing payload size slightly.

Cons #

• Increased Security Risk: If an HTTP/2 connection is hijacked, an attacker can access all protected paths for the session's duration—this is a bigger window of opportunity than per-request authentication (where short-lived tokens limit exposure).
• Stale Permissions: If a user's permissions change mid-session, your system won't pick up on it until the session ends or you force a re-authentication. Per-request validation would catch this immediately.
• Token Expiry Handling: If the JWT expires while the HTTP/2 connection is still active, clients will get unauthorized errors until they re-send a valid token and re-authenticate the session.

Verdict: This is a solid optimization for low-risk environments (like internal tools, trusted B2B clients) where performance gains outweigh security tradeoffs. For public-facing, high-risk systems, use it cautiously—pair it with short session timeouts, bind sessions to client IP/UA, or add periodic re-validation checks to mitigate risks.

Technical Implementation #

The core idea is to tie authentication state to the HTTP/2 connection (session) and cache valid auth data for subsequent requests. Here's how to pull it off:

Load Balancer Logic Flow #

1. Identify Sessions: Use the unique HTTP/2 connection identifier (e.g., TCP 4-tuple: source IP/port + destination IP/port, or HTTP/2's native connection ID) to group requests from the same session.
2. First Request Authentication: When the first request to a protected path arrives on a new connection, extract the JWT from the Cookie header, validate it (check signature, expiry, permissions, etc.).
3. Cache Auth State: If validation passes, store the JWT's payload (user ID, roles, expiry) in a cache (in-memory for single-node LB, distributed cache like Redis for multi-node setups) using the session ID as the key. Set the cache TTL to match or be shorter than the JWT's expiry time.
4. Skip Validation for Subsequent Requests: For all future requests on the same connection, pull the cached auth data instead of re-validating the JWT.
5. Clean Up: When the HTTP/2 connection closes (client disconnect, timeout) or the cache expires, delete the session's auth data. If a user logs out or their token is revoked, actively invalidate the cached entry.

Example with Nginx (HTTP/2 Enabled) #

Nginx supports HTTP/2 and can be extended with Lua scripts for custom auth logic:

http {
    # Cache for session auth data (adjust size/TTL as needed)
    proxy_cache_path /var/cache/nginx/jwt_sessions levels=1:2 keys_zone=jwt_cache:10m max_size=100m inactive=30m use_temp_path=off;

    server {
        listen 443 ssl http2;
        server_name yourdomain.com;

        location /api/protected {
            # Use TCP connection ID as cache key (unique per HTTP/2 session)
            proxy_cache_key "$connection";
            proxy_cache jwt_cache;
            proxy_cache_valid 200 30m; # Match JWT expiry

            # Validate JWT only if cache is missing
            if ($upstream_cache_status = MISS) {
                set $jwt_token "";
                # Extract JWT from Cookie
                if ($http_cookie ~* "jwt_token=([^;]+)") {
                    set $jwt_token $1;
                }

                access_by_lua_block {
                    local jwt = require("resty.jwt")
                    local secret = "your_jwt_secret"
                    local token = ngx.var.jwt_token

                    if token == "" then
                        ngx.status = 401
                        ngx.say("Unauthorized: No token provided")
                        ngx.exit(401)
                    end

                    local verified = jwt:verify(secret, token)
                    if not verified.verified then
                        ngx.status = 401
                        ngx.say("Unauthorized: Invalid token")
                        ngx.exit(401)
                    end

                    # Pass user data to backend
                    ngx.var.user_id = verified.payload.user_id
                    ngx.var.user_roles = verified.payload.roles
                }
            }

            # Forward auth data to backend
            proxy_set_header X-User-ID $user_id;
            proxy_set_header X-User-Roles $user_roles;
            proxy_pass http://your_backend_service;
        }
    }
}

Note: For multi-node load balancers, use a distributed cache (like Redis) instead of Nginx's local proxy cache to ensure auth state is shared across all LB instances.

Can Clients Send Tokens as Session-Specific Data? #

Absolutely! Here are the most practical approaches:

• First-Request Token: Clients send the JWT in the Cookie (or Authorization header) of the first request on a new HTTP/2 connection. Subsequent requests don't need to include the token—they rely on the load balancer's session cache. Modern HTTP/2 clients (browsers, curl, SDKs) automatically reuse connections by default, so this works seamlessly.
• Connection-Level Custom Headers: Some HTTP/2 client libraries support sending custom headers during connection setup, but this isn't part of the official HTTP/2 spec, so compatibility is spotty. Stick to the first-request method for broad compatibility.
• Session Metadata: A few advanced clients let you attach custom metadata to the HTTP/2 connection, but again, this is non-standard. The first-request token approach is the most reliable.

Just make sure your client is configured to reuse HTTP/2 connections (most are by default) to avoid unnecessary re-authentications for new connections.

内容的提问来源于stack exchange，提问作者ronag