How should I manage user session in CLI application?

Question

I'm developing a CLI based application. It has a "login" command to perform authentication:

$ myapp login 
$ Type username: hector
$ Type password: *****
$ Login success!

Internally, myapp login makes a request against a HTTP API and a authentication token (JWT) is returned, so I need to keep it in the client somehow, in order to send it in subsequent requests.

Should I store this token in disk? Or maybe keeping it in memory and make the session 'volatile'? Is there any pattern or well-known practice for this?

Answer 1

I found an answer here: https://stackoverflow.com/questions/9146217/how-does-heroku-store-its-authentication-on-its-command-line-app

It has a Heroku's site link and explains very well how they face this. Basically, they store authentication token in ~/.netrc file.

• Berin Loritsch: Key word is token. The value in password should be a one-way hash, preferably salted, etc. Bottom line is that if two people have the same password it shouldn't look like it in the .netrc file. Hopefully the ruby gem the Heroku team created will handle that detail for you. If not, be aware.
• Laiv: Storing contexts and sessions in hiden files and folders is quite common. In my recently experience with CLIs for cloud platform such as OpenShift, Azure and Bluemix I have realised that they, in essence, do the very same. Storing tokens in files is fairly common. One important thing to be aware of is the token expiracy. The use to be short-living tokens with no refresh tokens. Remember also the concurrency. Several processes reading-writing the same file might lead you to unexpected security issues.
• bdsl: And this is essentially the same as what happens when you log in to a website - the browser stores a cookie on disk, which acts as a token for access to your logged in session.

Answer 2

You should store the refresh token on the client if you have secure storage for it.