Key point
Main choice
Use sessions for most server-rendered web apps. Use tokens when your API must be called by separate clients like a mobile app, another backend, or a separate frontend domain.
The real question is simple: where will you store the signed-in state, and how will you revoke it when the user logs out?
What sessions mean
With sessions, the server stores the login state. The browser only keeps a random session ID, usually in a cookie.
On each request, the server reads the session ID, looks it up, and knows the user. Logout is easy because the server can delete that session.