3 ms·
Session ID: Server has a list of valid sessions. Compares your session ID to its own list. Have session token? Access granted. JWT: Server doesn't keep a list.
by WA 4y ago
Session ID: Server has a list of valid sessions. Compares your session ID to its own list. Have session token? Access granted.
JWT: Server doesn't keep a list. Someone comes with a JWT, which is signed by the server. Server grants access purely on the fact that there is a signed token.
JWTs are useful if you don't want to sync the server-side list of valid session ids (many microservices for example).
- deleted 4y ago[deleted]
- 0x457 4y agoThat's not entirely true. Session cookie doesn't have to be opaque and can be signed and encrypted. That's how RoR been using it for long time. Realistically, you only need to make sure that an unexpired and verified session hasn't been revoked. Opaque sessions are smaller, though.