JWT vs Session Cookies
Compare JWT bearer tokens vs server-side session cookies for API authentication. When would you choose each?
Answers use simple, clear English.
Quick interview answer
Sessions store state server-side (or in a shared store) and send an opaque cookie — easy revoke, sticky size. JWTs are self-contained claims verified by signature — good for stateless APIs and service-to-service, harder to revoke without blocklists/short TTL. Prefer HttpOnly Secure cookies for browser SPAs when XSS is a concern; use short-lived access JWT + rotating refresh for mobile/APIs.
Detailed answer
Sessions store state server-side (or in a shared store) and send an opaque cookie — easy revoke, sticky size. JWTs are self-contained claims verified by signature — good for stateless APIs and service-to-service, harder to revoke without blocklists/short TTL. Prefer HttpOnly Secure cookies for browser SPAs when XSS is a concern; use short-lived access JWT + rotating refresh for mobile/APIs. Putting long-lived JWTs in localStorage is an XSS footgun.
Full explanation
Putting long-lived JWTs in localStorage is an XSS footgun.
Real example & use case
Internal microservice mesh uses short JWT; consumer website uses session cookie behind BFF.
Pros & cons
Pros of JWT: horizontal scale without sticky sessions. Cons: revocation and secret rotation complexity.