LESSON 3.1
Sessions versus JWTs
Learn key techniques and workflows in Practical Web Security.
8m
intermediate
9,156 students
Overview
Server sessions are revocable; JWTs are stateless and awkward to revoke. Pick based on whether you need to log someone out immediately.
In this lesson you will:
- Compare revocability and statelessness honestly
- Store tokens in cookies with the right flags
- Design refresh and logout before you ship
Pro Tip
Use caching and revalidation wisely to ensure your app stays fast and data remains fresh without unnecessary requests.