Server sessions vs stateless tokens

Authentication and authorization Junior Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

A first-party web app needs instant logout and admins must be able to kill a session. Best fit?

Options
Hint 1 of 1

Where does revocation need to happen?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Server-side sessions with an HttpOnly, Secure, SameSite cookie

Correct. Revocation is deleting the session.

Revoking a session is just deleting a row on the server. A self-contained token stays valid until it expires unless you add a server-side check, which is the session model again.

Why not the others?
  • B A 30-day JWT in localStorage. Readable by XSS and can't be revoked before expiry.
  • C A 30-day JWT in a cookie. Still unrevocable without extra state.
  • D Basic auth on every request. Sends the password every time.

30-second answer

A server session stores state on the server (in a database or Redis) and gives the browser a random session id in an HttpOnly cookie; logging out or revoking is just deleting the row. A stateless token like a JWT carries signed claims, so any service can check it without a lookup, but it stays valid until it expires unless you add a deny list. For a browser app talking to its own backend, sessions are usually simpler and safer; tokens shine between services and for third-party API access.

Practise saying it · 35 s. No recording, just a timer

Sessions or tokens?

Say your answer out loud, then check which of these points you covered:

  • Where state lives
  • Revocation
  • HttpOnly cookies vs localStorage
  • Tokens between services

Deep dive

Session ids must be long and random (128 bits or more) and rotated at login to prevent fixation.

Keep JWT access tokens short-lived (minutes) and pair them with refresh tokens.

Storing tokens in localStorage exposes them to any XSS; HttpOnly cookies don't.

Many systems use both: a session at the edge, short tokens between services.

Common mistakes

  • Long-lived JWTs with no way to revoke them.
  • Putting session data in a JWT and making it huge.
  • Tokens in localStorage on a site with third-party scripts.

Senior take & follow-ups

Contrast where state lives, revocation and exposure, then pick per context.

Follow-up questions

Think of your answer first, then open the hint.

  1. How do you log out a JWT user immediately?

    Show hint

    Short expiry plus a deny list or a token version checked per request.

  2. Why rotate the session id at login?

    Show hint

    To stop session fixation attacks.

Related questions

Suggest a fix if something here is wrong or out of date.