CODEWITHSUNDEEP
web-servicesauthenticationsessionjwtscalability
EdH
EdH

Reputation: 115

JWT (Token based authentication) vs Session / Cookies - Best Usage

I've been reading up on this topic a lot but could not find a good answer that I was looking for.

So my understanding of the pros and cons of JWT vs Session is

JWT pro

con

Session pro

con

So given my understanding,

  1. which approach does website that supports huge number of users (amazon, uber) use? Is using session w/ distributed cache good enough?

  2. what is the real life use case where it makes more sense to use JWT (token based) over session based?

Thank you!

Upvotes: 7

Views: 7653

Answers (2)

Nitin Gaur
Nitin Gaur

Reputation: 1126

JWT was born to provide secured access to APIs from mobile apps. Software developers started using them for web browser based clients as well but they are not suited due to security concerns. You will find many articles on this topic. For web application, it is best to store token at server side, link it with a new session, return the session after login to the web browser and store it in the session cookie.

Upvotes: 4

Michal Trojanowski
Michal Trojanowski

Reputation: 12322

JWTs were never designed for handling sessions. They are a way of exchanging integrity-protected messages between services. Have a look at this article: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ which explains why using JWTs for handling sessions is not a good idea.

You can also read about the BFF pattern: https://curity.io/resources/learn/the-bff-pattern/ where you use a lightweight backend component for handling tokens, and still deal only with sessions in the frontend. Because it's a light component it's easy to scale it - e.g. it can be a lambda function.

So in my opinion, there are no real good use cases where you genuinely prefer JWT-based session over cookie-based session, but (as any strong opinion), this may trigger a discussion ;)

Upvotes: 10

Related Questions