Authentication & Authorization Architecture · Identity, Tokens and Access
Sessions vs Tokens: JWTs, Cookies and Refresh Tokens
Choose between server-side sessions and self-contained tokens, and store them safely.
Server-side sessions store state on the server and give the browser an opaque ID in an HttpOnly cookie — easy to revoke, simple for web apps. Self-contained tokens (JWTs) carry signed claims and are verified without a lookup — convenient for APIs and microservices, but hard to revoke before expiry. A common hybrid: short-lived JWT access tokens (5–15 min) plus long-lived, rotating, revocable refresh tokens. For browser apps, a BFF (backend-for-frontend) can keep tokens server-side and give the browser only a session cookie.
| Aspect | Server session (cookie) | JWT access token |
|---|---|---|
| Revocation | Immediate (delete session) | Wait for expiry / denylist |
| Lookup per request | Yes (Redis/DB) | No (verify signature) |
| XSS exposure | HttpOnly cookie: not readable | If in localStorage: stealable |
| CSRF exposure | Yes → SameSite + CSRF token | No if sent in Authorization header |
| Best for | Web apps, BFFs | APIs, service-to-service |
Common pitfalls
- Storing tokens in localStorage in XSS-prone apps.
- Long-lived JWTs with no revocation strategy.
- Putting sensitive data or volatile permissions in JWT claims.
Key points
- Sessions: simple revocation; tokens: stateless verification
- Short access tokens + rotating refresh tokens
- BFF keeps tokens out of the browser
Further reading: IETF: OAuth for Browser-Based Apps
Practice questions
How do you log a user out everywhere when using JWTs?
Answer
Keep access tokens short-lived and revoke the user's refresh tokens/sessions server-side (or bump a token version checked at refresh), so new access tokens can't be obtained.
What is refresh token rotation with reuse detection?
Answer
Each refresh returns a new refresh token and invalidates the old one; if an old token is presented again, the server assumes theft and revokes the whole token family.
Open in the app to mark lessons complete, take notes and track your progress.