What is the difference?

This section covers differences in various topics.

Session Based Authentication vs JWTs

Session

• User session information is stored at the backend server in a database or session storage, returns a unique session id to the user
• All the relevant information about the user's login such as profile data, roles and permissions, user settings are possibly stored along with session information.

Advantages

• Client doesn't have to worry about handling session at client side app

Disadvantages

• Increases the server load
• Scalability issues due to sticky session

JWT

• User information is encrypted and returned to the client by the backend server in the form of json web token
• No session information is stored in the backend server

Advantages

• No separate stored needed
• Scalability is easier

Disadvantages

• Invalidating a jwt is not easy, with session, it can be simply deleted from the session store
• Data in the jwt can become stale
• Token expires after the set time, client has to request for a new token, server has to issue new jwt