developed by WeChat Mini Programs, I have obtained openid and session_key, from the server through api. I use redis to store session, but redis to store the key value. If you still have any questions, I"d like to ask for advice.
some people directly use code as the key, session_key as the value, and then request responses with code;
some people use openid as the key and session_key as the value, is it safe;
is it safe to generate token, request responses through string concatenation of openid, session_key, md5, etc.
or do you directly use the third-party package jwt, to generate strict token strings?
ask experienced friends, what is the safest and most convenient key to use?