ABOUT

Exploring JWT and Sessions + Redis for user auth

JSON Web Tokens (JWT)

• Stateless approach. No database required but client-side must save the token (via cookie or localStorage - not recommended).
• Good for server-server communications or microservices architecture.
• Uses the concept of refresh tokens, where an expired access token is secretly refreshed and given a new token without logging out the user.
• Refresh tokens can be stored in a database and must be encrypted (but it loses its statelessness)

Sessions

• Stateful approach. Authentication data should be stored in both the client and server side.
• Sessions can easily be invalidated.
• Sessions are generally recommended than JWT.

READINGS

• An Introduction to Identity and Access Management
• Difference between Session Cookies vs. JWT (JSON Web Tokens), for session management.
• Why you should not use JWT
• API Authentication techniques
• JSON Web Tokens (JWT) — the only explanation you will ever need
• Authentication on the Web