Q5: Compare Stateful Session Authentication with Stateless JWT Authentication.
In Stateful Session Authentication, the server generates a random Session ID upon login, stores session state in memory/database (e.g., Redis), and returns the Session ID in an HTTP cookie. On each request, the server looks up the Session ID in the database.
In Stateless JWT Authentication, all user context and permissions are encoded directly inside the signed JWT payload returned to the client. Resource servers validate the token cryptographically without making database lookups.
Sessions vs JWTs
State Management:
Server-side Database vs Client-side PayloadSessions require centralized cache lookups; JWTs self-contain user state.
Revocation Speed:
Instant (Delete session record) vs Complex (Requires blacklist)Session revocation takes effect immediately; JWTs remain valid until exp unless blacklisted.
Horizontal Scalability:
Requires Shared Session Store vs Inherently ScalableJWTs allow any microservice instance to validate requests independently.
Key Takeaways
- Session authentication enables instant server-side revocation but creates database lookup bottlenecks.
- JWT authentication scales effortlessly across microservices but complicates token revocation.