JWT vs Cookies for Authentication

I go over the pros and cons of using JWT vs Cookies and which one you should use for authentication.

Links from video:

----

----

----

----
Follow Me Online Here:

#benawad
​
----
#benawad

[Kamillascookie]

I wish my architect was this good at explaining stuff. You are awesome!

[alenw]

Good video. Just wanted to mention that JWT stands for JSON Web Token, so it's redundant to say JWT token - you're basically saying 'token' twice. Cheers!

[KoltPenny]

If it is really JWT vs Session I recommend you change your title because I've been looking for this for months.

[IgorPomaranskiy]

Probably it was worth to be mentioned: usage of tokens (which is _usually_ the case when you go for JWT) vs cookies (which is _usually_ the case when you go for sessions) allows you to not bother about CORS etc.

[natqe]

I love this kind of tutorials! thanks ben

[johnferrara]

Really cleared up when and why to use which one for me.

[ohnoitsretarded]

i cant remember the last time i commented on a video (maybe like 9 years ago), but i just had to cos when i finished watching ur video and saw your name, i was shocked HAHAHA, i saw u q a few times on tiktok but i didnt know u had a youtube channel!!! anyways, im doing some pen tests on jwt, and this video really helped!! especially introducing that jwt website haha i gs ill follow ur tiktok now

[ManojSingh-ofep]

I use jwts and I dont know why would a send a lot of data using jwt. I create jwts only using a particular id.

[magnifico]

Can you create example tuts using redis to store sessions and use it to authenticate two servers. Thanks

[shafu_xyz]

What's popular method for user authentication and authorization, like in Facebook Google etc? Also how does jwt compares with Oauth etc?

[mtushar]

Hi Ben, what software are you using there for the diagrams?

[jindon]

Hi Ben, just want to know your choice. Suppose you have an e-commerce site that uses REST API and a react frontend, which one will you choose to use? Basic JWT or Cookies?

[DrPanesar]

Hi Ben, Thanks for the discussion about pros and cons of JWT vs Cookies. I think you have covered the really important ones. Personal i use cookies and sessions for most of my projects. The main reasons for me are the ability to keep data server side and private and to allow multiple sessions and login across devices which can be invalidated at any time like a password reset or logout. I worry about JWT and security as the data your sending is really vulnerable. Say i copy out a JWT from a web browser someone else is using and decrepit it to read that individuals data. That feels so risky and i don't think big tech companies use JWT for mission critical data transfer for their Apps. I might be wrong but i've only really seen them use cookies...

[CoryTheSimmons]

8:00 is how I feel but /dev/null's comment about refresh tokens is also correct.

[biggur]

i need some help. Im doing a short course and im not that good. My task was to go right click on the padlock on the left of the site address (next to the https//) then to click on cookies, expand it and then click on 'token' but now all of a sudden my 'cookies and site data' tab is not expanding anymore and i cant obtain a 'token' it was fine earlier . i am using chrome and firefox and its not working now. It was working earlier on the day. i would be very grateful for some help from anyone

[flitchingcl]

I am a fan of jwt but it is less secure, in compare with session, till someone can still jwt token from local storage and expire time can not save you. But to pros of jwt I can say, session can not be using in other domain.

[saysoy]

how about encrypting the jwt then sending it to the client, store it in a cookie, then send it back to the server whenever you need to access some data. (it will be decrypted in the server again)

[rickyu]

What is your suggestion for anonymous users? I need a way to keep track of anonymous users who i am allowing to do limited operations on my site. but not sure how to treat non registered users.. I could fingerprint them, but i would rather create a userid in mongo jwt may be overkill as they dont have passwords.

[SiddiqNx]

Where will you store the refresh token in the client? If it's stored in local storage, isn't it insecure, per se? Doesn't it mean a hacker can perform an XSS attack and get the refresh token? Which means, the hacker can use the refresh tokens to generate access tokens as much as he wants. What am I missing?

[siafudev]

I decided to use sessions instead of JWT tokens. However, if I set the security flag httpOnly. I can't read the cookie set by Express. How do you handle this within your Angular apps without giving up the security that the httpOnly flag gives you?