Sessions vs tokens
Server-side sessions and self-contained tokens such as JWTs compared: how each works, revocation, scaling, storage in the browser, XSS and CSRF exposure, access and refresh tokens, the backend-for-frontend pattern, mobile apps and APIs, and a clear recommendation for typical web applications.
CodexBash, , 6 min read
After a user signs in, every following request must prove who they are. There are two main designs. With server-side sessions, the server stores the login state and gives the browser an opaque ID in a cookie. With tokens, usually JWTs, the server gives the client a signed token containing the user's identity, and verifies the signature on every request without storing anything. Both are secure when done right, and both are frequently done wrong. This article compares them honestly and recommends when to use each.
Sign in to read the rest
The whole 6 minute article is free with an account, along with every problem, lesson and tutorial. No card.