Session management using json web tokens in microservices -

i trying figure out how manage sessions using json web tokens in microservice architecture.

looking @ design in article have in mind client send request first goes through firewall. request contain opaque/reference token firewall sends authorization server. authorization server responds value token containing session information user. firewall passes request along value token api, , value token propagated different microservices required fulfill request.

i have 2 questions:

1. how should updates session information in value token handled? elaborate, when session info in token gets updated, needs updated in authorization server. should each service changes token talk authorization server?
2. should microservices use single token store session info? or better each service have personalized token? if it's latter, please explain how adjust design.

a very(!) significant "fly in ointment" of kind of design ... requires careful advance thought on part ... is: “precisely what meant ‘session’ information.” in architecture, “everyone racing else.” if session information updated, not , cannot(!) know of agents knows change , not. further complicate things, new requests arriving asynchronously , overlap other requests in unpredictable ways.

therefore, authorization server must ... and, no more. validates (authenticates ...) opaque token, , supplies trustworthy description of request authorized do. but, information harbors cannot change. , specifically, cannot hold “session state” data in web server sense of term.

each microservice provider must maintain own “tote board” *(my term ... “its own particular subset of in web-server ‘the session pool’”), , desirable not feasible board independent of others. certainly, must use central database (with transactions) coordinate other service-providers situated. , still, if truth content of of these “totes” causally related other, have out-of-sync issue between them.

although microservice architecture has academic appeal, imho designs must carefully studied are, in fact, compatible approach.