Lesson 3.1
Sessions versus JWTs
Server sessions are revocable; JWTs are stateless and awkward to revoke. Pick based on whether you need to log someone out immediately.
8mIntermediate9,156 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
Server sessions are revocable; JWTs are stateless and awkward to revoke. Pick based on whether you need to log someone out immediately.
What this lesson covers
- Compare revocability and statelessness honestly
- Store tokens in cookies with the right flags
- Design refresh and logout before you ship
This lesson sits in Authentication Done Right, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- Compare revocability and statelessness honestly
- Store tokens in cookies with the right flags
- Design refresh and logout before you ship