Sessions versus JWTs

Server sessions are revocable; JWTs are stateless and awkward to revoke. Pick based on whether you need to log someone out immediately.

8m
Intermediate

Video thumbnail for Sessions versus JWTs

Video by TechStack Journey · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

Compare revocability and statelessness honestly
Store tokens in cookies with the right flags
Design refresh and logout before you ship

This lesson sits in Authentication Done Right, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

Compare revocability and statelessness honestly
Store tokens in cookies with the right flags
Design refresh and logout before you ship

Resources

OWASP Top 10The official reference for the tools used in this lesson.