Auth was handled via JWT secure cookies, but mobile apps seemingly do not apply set-cookie headers. So instead I switched over to header based auth, but then I realized header based auth doesn't work well with image fetches which the DNA codec relies heavily on. So I had to add query auth support too which isn't optimal.
In hindsight I should've kept cookie support and should've just handled the set-cookie header myself to store the cookie persistently on the mobile app. This also would've made it easier to support both websites and mobile apps in the future.
But naturally, hindsight is 2020, and I'm too deep in to change it now. I'll go with this implementation for now and in the future I might switch back to cookie exclusive authentication.
Auth was handled via JWT secure cookies, but mobile apps seemingly do not apply set-cookie headers. So instead I switched over to header based auth, but then I realized header based auth doesn't work well with image fetches which the DNA codec relies heavily on. So I had to add query auth support too which isn't optimal.
In hindsight I should've kept cookie support and should've just handled the set-cookie header myself to store the cookie persistently on the mobile app. This also would've made it easier to support both websites and mobile apps in the future.
But naturally, hindsight is 2020, and I'm too deep in to change it now. I'll go with this implementation for now and in the future I might switch back to cookie exclusive authentication.