Main choice
Use sessions for most server-rendered web apps. Use tokens when your API must be called by separate clients like a mobile app, another backend, or a separate frontend domain.
The real question is simple: where will you store the signed-in state, and how will you revoke it when the user logs out?
What sessions mean
With sessions, the server stores the login state. The browser only keeps a random session ID, usually in a cookie.
On each request, the server reads the session ID, looks it up, and knows the user. Logout is easy because the server can delete that session.
What tokens mean
With tokens, the client stores a signed token. The server checks the token on each request and trusts its contents if the signature is valid.
Tokens are common for APIs and mobile apps. Logout is harder because a valid token can remain valid until it expires, unless you add a denylist or use short expiry with refresh tokens.
Choose by app shape
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done
Common mistake
Do not use JWTs only because they sound more advanced. A JWT is not automatically safer than a session.
Also do not store long-lived tokens in localStorage without thinking through theft by injected JavaScript. You will handle storage details in the cookie lesson, but your choice starts here.
README note
Add a small section like this to your repo. It tells a recruiter that you made an auth design choice, not just copied a package setup.
Auth choice
This app uses server-side sessions.
Reason:
- The app is a normal web app with browser users.
- The backend can store and revoke sessions.
- Logout deletes the server session, so access stops immediately.
- The browser only receives a session id, not the user password or user record.
Security checks:
- Passwords are hashed before storage.
- Protected pages check the session before returning user data.
- Session cookie settings are documented in the cookie section.Ask AI well
AI can help you compare choices, but give it your app shape. Ask for risks, not just code.
Check the answer for three things: where state is stored, how expiry works, and how logout or revocation works.
Prompt:
I am building a web app with Express and React for college event registrations.
Users sign in from a browser. The backend and frontend are on the same domain in production.
Should I use server-side sessions or JWT access tokens?
Compare storage, logout, expiry, and what I should write in my README.Do this now
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done