# JWT vs Session Based Authentication

## JWT vs. Session Based Authentication (SBA)

### JWT

* **Stateless** - server don't need to keep record of the token

### SBA

* **Stateful** - Sessions are stored server-side for **PROPER** SBAs

<figure><img src="https://4157702631-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FslGw3ZF0EFGfkPZZ1EMu%2Fuploads%2FXtvS7Z6W3NFi7Yi36bV2%2Fimage.png?alt=media&#x26;token=b57bf445-f793-4bb0-805c-49f2aeca8964" alt=""><figcaption><p>JWT authentication Process</p></figcaption></figure>

<figure><img src="https://4157702631-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FslGw3ZF0EFGfkPZZ1EMu%2Fuploads%2F4aTFJRHSmCm1WX1bb8m3%2Fimage.png?alt=media&#x26;token=ee75a21e-ac6f-4d4e-bafc-6f67a604cead" alt=""><figcaption><p>SBA process </p></figcaption></figure>

## Advantages of JWT

### Scalability:

* Due to their stateless nature, JWTs are ideal for distributed systems.&#x20;

### Flexibility:

* They can be used across different domains and applications.&#x20;

### Security:

* When properly implemented, they provide a secure way to handle user authentication.
* Implement short-lived JWTs and use refresh tokens for renewing access without re-authentications

## Disadvantage of JWT

### Transmission Security:

* MUST transmit JWTs over HTTPS
* Else it can be sniffed/stolen and abused&#x20;

### Storage:

* Storage of JWTs are entirely on client side, thus it is important to store them securely to prevent XSS attacks and other vulnerabilities&#x20;

### Unpredictability:

* It does not have revocation efficiency
* If a valid JWT token stolen during its validity period, it can be used for authentication without the user's knowledge even if the user has logged out
* To prevent this, additional processing logic at the backend has to be used, this leads to more overhead and partially defeats the purpose of using JWT, when the goal was to be stateless to begin with

## Advantages of SBA

### Simplicity and Reliability:

* The server's session record acts as a centralized truth source, making it straightforward to manage user sessions.&#x20;

### Revocation Efficiency:

* Access can be quickly revoked by deleting or invalidating the session record, ensuring up-to-date session validity.

## Disadvantages of SBA

### Performance Issues (High Latency) at Scale in Dynamic Environments:

* The dependency on database interactions for every session validation can introduce latency, especially for high-traffic applications.
* In applications with dynamic clients, this latency can impact user experience, making session-based authentication less ideal in such scenarios.

## **Why is JWT good?**

* Cross Site Request Forgery (CSRF) uses cookies to direct forged attacks towards a target, if the user has a cookie that is stored on the browser, this attack vector will be able to abuse the cookie to accomplish their malicious actions

<figure><img src="https://4157702631-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FslGw3ZF0EFGfkPZZ1EMu%2Fuploads%2Fy9dgYukAzKbMSV2LkYzL%2Fimage.png?alt=media&#x26;token=995bb720-499e-4b10-8882-29a29019a73d" alt=""><figcaption><p>Example of a CSRF URL embedded in an &#x3C;a> tag</p></figcaption></figure>

* As JWT does not use cookies, it negates CSRF attacks



## What to do in the process of choosing the type for a server setting?

Python choose if else to determine your needs XD

```
requirement = input("What are your needs?") 

if ("stateless" in requirement.lower()):
	print("JWT")
elif ("scalable" in requirement.lower()):
	print("JWT")
elif ("secure" in requirement.lower()):
	print("JWT")
elif ("immediate control" in requirement.lower()):
	print("SBA")
else:
	print("Rethink what you want :)")
```

## Long story(code) short:

If you need **stateless**, scalable, and/or more security then choose JWT

If you want  efficient immediate control, choose SBA



## **Want MORE security?**

* Meet JSON Web Encryption (JWE)
* It is the encrypted form of JWT, using 5 header sections instead of 3

<figure><img src="https://4157702631-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FslGw3ZF0EFGfkPZZ1EMu%2Fuploads%2FYJAxnaaYJ1vReqRzFWdk%2Fimage.png?alt=media&#x26;token=a03529bd-30d5-4211-959c-a67835ccc1ec" alt=""><figcaption><p>JWE Using 5 headers instead of 3</p></figcaption></figure>

* It is significantly considered harder to decrypt compared JWT, providing more security for end users (Disclaimer: This still DOES NOT mean you should store sensitive information in the JWE)
* More about JWE&#x20;
  * https://www.forgebox.io/view/JWTSignEncrypt
  * https://www.scottbrady91.com/jose/json-web-encryption

### Interview questions:

* What is the difference between JWT and session based authentication?&#x20;
* What is the advantage and what's the disadvantage in the comparison of JWT to session?

Additional Questions:

* What is the recommended way to store JWT tokens on the client-side if I really need to (cookie)?
* How does JWT handle token expiration and refreshment?
* How does JWT ensure the integrity of the data it carries?
* How does a server validate a JWT token?

#### Author: [`Ninjarku`](https://github.com/Ninjarku)🐱‍👤

### References

* [https://juejin.cn/post/7110044736848658445  ](https://juejin.cn/post/7110044736848658445https:/dev.to/codeparrot/jwt-vs-session-authentication-1mol)
* [https://dev.to/codeparrot/jwt-vs-session-authentication-1mol#:\~:text=Choosing%20between%20JWT%20and%20session,authentication%20holds%20the%20upper%20hand.](https://juejin.cn/post/7110044736848658445https:/dev.to/codeparrot/jwt-vs-session-authentication-1mol)
* [https://blog.logrocket.com/jwt-authentication-best-practices/#:\~:text=To%20reiterate%2C%20whatever%20you%20do,JWTs%20inside%20an%20HttpOnly%20cookie.](https://blog.logrocket.com/jwt-authentication-best-practices/)
* [https://iq.opengenus.org/user-authentication-techniques-types/](https://iq.opengenus.org/user-authentication-techniques-types/)
* [https://www.forgebox.io/view/JWTSignEncrypt](https://www.forgebox.io/view/JWTSignEncrypt)
* [https://www.scottbrady91.com/jose/json-web-encryption](https://www.scottbrady91.com/jose/json-web-encryption)
* [https://www.freecodecamp.org/news/how-to-sign-and-validate-json-web-tokens/#:\~:text=When%20your%20authentication%20server%20receives,incoming%20JWT%20can%20be%20trusted.](https://www.freecodecamp.org/news/how-to-sign-and-validate-json-web-tokens/)
