Sessions vs JWT
Opaque server-side sessions or self-contained signed tokens: what each costs in lookups, revocation and size, how to validate a JWT safely, and where to keep it.
25 min6 steps
By the end you can
- Compare server-side sessions with self-contained tokens on revocation, lookup cost and size
- List the checks a server must make before trusting a JWT
- Size a denylist for revoking self-contained tokens before they expire
- Choose access and refresh token lifetimes by trading revocation delay against refresh load
- Choose where a browser keeps a credential, and which cookie attributes protect it
A pointer or a passport
A JWT is signed, not encrypted: never put secrets in it.
Server-side session
- Opaque random ID (64+ bits)
- Store lookup per request
- Revoke instantly: delete row
JWT (RFC 7519)
- Signed claims: sub, exp, aud
- No lookup, any service verifies
- Valid until exp; bigger per request
Validating a JWT
Most JWT bugs trust the token's own header: alg: none, or algorithm confusion (RS256 server tricked into HS256 with its public key). Pin the algorithm and key on the server (RFC 8725).
Revoking a token that verifies itself
A self-contained token cannot be deleted. Wait out exp, or keep a denylist of revoked jti. Entries only live until the token would expire, so size = revocations per time × token lifetime (Little's law). Checking it per request is the lookup JWTs avoided, but a far smaller set.
t0
Token issued, exp = t0 + L
t1
Revoked: jti added to denylist
t0 + L
Token expires: entry can go
Loading question…
Short access tokens, rotating refresh tokens
Short access tokens (minutes, verified locally) plus a refresh token only the auth server accepts. Rotation: each refresh returns a new token; reuse of an old one reveals theft and revokes the family (RFC 9700). Shorter lifetimes cost refresh traffic.
Loading question…
Where the browser keeps it
Anything JavaScript can read, XSS can steal. Regenerate the session ID at sign-in.
HttpOnly
- Scripts cannot read it
Secure
- HTTPS only
SameSite=Lax
- Blocks most cross-site sends
- Add CSRF tokens
localStorage or URL
- XSS reads it
- URLs leak to logs and Referer
Check your mastery
Score 80% or more.
Mastery check
4 questions on fresh variants. One attempt each, no time limit. Score 80% or more to master the lesson.
Next: OAuth 2.0 and OpenID Connect.
Answer this step to continue.