Hi,

    just looking for advice, when a user registers I would like them to have a URL token assigned to them, not a problem with that,  what I would like to know is the best practice for allowing them access to part of the website that generates an HTML to PDF, the user, from their site uses Curl with the URL token and the URL that they would like converting to HTML.

What I would like to know is the following

• it best to store a session against that user in a database table?
• how long should I allow the token to be active for 3 months 6 months?
• do I need to give them a refresh token?

or am I over complicating things?

thanks

I would say yes to store a session against a user and you should also store where the requests came from. This data is great to work out usage and also helpful to detect abnormal behaviour. As to the token length of time or if to refresh, i'm guessing this is some sort of api connecting from their end so the token validates the request, if so then there's no point in changing it.

 

Thanks, i have just set it up, put the token in the header as a  bearer token, if you want a token key for free let me know, it does HTML to PDF, screenshots to PDF, XML site map and few other ideas i am working on