Offline Access and Authentication
A forum discussion on offline access and authentication explores methods and considerations for implementing authentication functionality when users are not connected to the internet.
Background
- FusionAuth is an open-source customer identity and access management (CIAM) platform, similar to Auth0 or Okta. This forum post is about designing authentication for apps that need to work without an internet connection.
- "Offline access" refers to letting a user continue using an app (e.g., a mobile banking app or a field-service tool) when the device is not connected to the internet. The challenge is verifying the user's identity and permissions without reaching the central authentication server.
- Key concepts involved: OAuth 2.0 and OpenID Connect (OIDC) — standard protocols for authorization and single sign-on. "Refresh tokens" can issue new access tokens without the user re-entering credentials, but they typically require a network call.
- The post explores trade-offs: storing credentials locally (security risk), using long-lived tokens (harder to revoke if a device is stolen), or implementing a local authentication mechanism that syncs with the server when connectivity returns.
- This matters because many modern apps (field service, healthcare, point-of-sale, travel) must operate reliably offline, and identity architects need patterns that balance security with usability.