JSON Web tokens vs sessions for authentication | should you use JWTs as session tokens?

In this video we cover whether you should use JSON Web tokens as session tokens. The answer might surprise you.

Mentioned blog posts for further reading

00:00 should you use JWTs as session tokens?
00:26 how server-side sessions with a session store work
01:55 how "client-side" sessions with JWTs work
04:03 logging out users from the server side
05:22 knowing who is currently logged in
06:11 session data visibility
06:42 revoking roles and privileges in JWT and session-based systems
08:00 scalability of server-side and client-side sessions
08:58 the need to maintain a session store
09:16 bandwidth consumption
09:38 attacking JWTs vs session-based authentication
11:11 cookies vs local storage
11:54 mitigating CSRF attacks

[jgoebel]

Let me know what you think about this video.
Feel free to also post any video ideas in the comments below

[jmrah]

Lucid and cogent talk. I learned quite a bit. Thanks for taking the time to put this together.

[paulwong]

Also thanks so much for this video. I learned a lot. I feel like the comparison has been so confusing and unclear. I now understand either way we're storing sessions, it's just whether you store them server side in a session store like redis OR client side via a JWT on the browser. That really clarifies the argument for me. In addition, all the other info in this video and your other videos are excellent explanations! Thanks you.

[paulgreen]

Nice presentation - I had come to the same conclusion but you cover it and explain it really well!

[furqananwar]

I didn't even think about these scenarios (drawbacks ) of JWT. Thanks for sharing 🙂

[austinmusiku]

This is really really good. Your well articulated points backed by nicely done illustrations helped me better understand the concepts

[karlopest]

This video made me change my mind about JWT. Great content here

[thekeykan]

Super duper helpful! Thank you for the great explanation. It is really thoughtful, easy to understand and clean. 👌

[HaraldEngels]

I was always considering to switch from my battle-tested (APCu/Redis) session based solution to JWT. You successfully dissuaded me. Thank you for opening my eyes.

[hagridhaired]

Super helpful and clear! Thank you for this great video.

[sergiim]

You are producing amazing content. Thank you a lot !

[abhishekbehera]

Thank you for this wonderful video with so much information yet, so simple to understand!

[davidkuda]

Hey man, this was really helpful and insightful, I like how you put together the table and summarised the topic there. Thanks for creating this content.

[dataluchs]

This was helpful, thanks! More informative content like that please

[bernardodomeneghetti]

Thank you for processing so much information for this vídeo

[moolipit]

Case #6: Need to maintain session store - I'd say its also "Yes" for JWT since you need to maintain a token blacklist. So it's yes for both and you better off maintaining whitelist (session than a blacklist (JWT)

[Cognitoman]

Damn 😂 this changed my mind on JWT by a lot... I already knew they had issues... but after watching this and read blog posts... I can’t think of any good reason to use them, except for maybe verifying emails for created accounts on your website😂...

[urevvlc]

JWT for microservices, Sessions for monolith(Load balance too)

[dfrontierit]

I like this video. It makes me trust my policy more.. "Modern practices may sometimes not be the best choice until field tested over many years". Let me know if i am thinking wrong

[rajarshibarman]

damn you convinced me sessions are better than jwts... hats off brilliant explanation bro