Session vs Token Authentication

Authentication Fundamentals

Authentication verifies user identity. The question is: where do you store the authentication state?

Every web application needs to authenticate users. Once a user logs in, subsequent requests must prove they are who they claim to be. There are two fundamentally different approaches:

Session-Based Authentication

The traditional approach used by monolithic web applications. The server maintains a session store (in-memory, Redis, database) that maps session IDs to user data.

How It Works

Implementation Example (Python/Flask)

from flask import Flask, request, jsonify, session
from flask_session import Session
import redis

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'
app.config['SESSION_TYPE'] = 'redis'
app.config['SESSION_REDIS'] = redis.StrictRedis(host='localhost', port=6379)
Session(app)

@app.route('/login', methods=['POST'])
def login():
    """Login endpoint - create session"""
    data = request.json
    username = data.get('username')
    password = data.get('password')
    
    # Validate credentials (check database)
    user = validate_user(username, password)  # Your validation logic
    if not user:
        return jsonify({"error": "Invalid credentials"}), 401
    
    # Create session (stored in Redis automatically by flask-session)
    session['user_id'] = user['id']
    session['email'] = user['email']
    session['role'] = user['role']
    
    return jsonify({"message": "Login successful"}), 200

@app.route('/profile')
def profile():
    """Protected route - requires session"""
    if 'user_id' not in session:
        return jsonify({"error": "Unauthorized"}), 401
    
    user_id = session['user_id']
    # Fetch user data from database
    return jsonify({"user_id": user_id, "email": session['email']})

@app.route('/logout', methods=['POST'])
def logout():
    """Logout - destroy session"""
    session.clear()  # Removes session from Redis
    return jsonify({"message": "Logged out"}), 200

def validate_user(username, password):
    # Placeholder for database validation
    return {"id": 123, "email": "[email protected]", "role": "user"}

Benefits

• Easy Revocation: Logout is immediate—just delete the session from the store.
• Server Control: Can update session data without client involvement (e.g., change user roles mid-session).
• Security: Session ID in HTTP-only cookie prevents XSS attacks (JavaScript can't access it).
• Auditing: Easy to track active sessions, concurrent logins, and user activity.

Drawbacks

• Server-Side Storage Required: Need Redis, Memcached, or database for session store.
• Horizontal Scaling Complexity: All servers must access the same session store (sticky sessions or shared store).
• Database Dependency: Every authenticated request queries the session store.
• CORS Complexity: Cookies don't work well with cross-origin requests from different domains.

Token-Based Authentication (JWT)

Modern approach favored by APIs and mobile apps. The server signs a JWT containing user data and sends it to the client. The client includes the token in every request.

What is JWT?

JSON Web Token (JWT) is a compact, self-contained token with three parts:

How It Works

Implementation Example (Python)

import jwt
from datetime import datetime, timedelta
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET_KEY = "your-secret-key"  # Use RS256 with public/private keys in production

@app.route('/login', methods=['POST'])
def login():
    """Login endpoint - issue JWT"""
    data = request.json
    username = data.get('username')
    password = data.get('password')
    
    # Validate credentials
    user = validate_user(username, password)
    if not user:
        return jsonify({"error": "Invalid credentials"}), 401
    
    # Create JWT payload
    payload = {
        "sub": user['id'],  # Subject (user ID)
        "email": user['email'],
        "role": user['role'],
        "exp": datetime.utcnow() + timedelta(hours=1),  # Expires in 1 hour
        "iat": datetime.utcnow()  # Issued at
    }
    
    # Sign JWT
    token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
    
    return jsonify({
        "access_token": token,
        "token_type": "Bearer",
        "expires_in": 3600
    }), 200

@app.route('/profile')
def profile():
    """Protected route - requires JWT"""
    auth_header = request.headers.get('Authorization')
    if not auth_header or not auth_header.startswith('Bearer '):
        return jsonify({"error": "Missing or invalid Authorization header"}), 401
    
    token = auth_header.split(' ')[1]
    
    try:
        # Verify signature and decode payload
        payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
        user_id = payload['sub']
        email = payload['email']
        
        return jsonify({"user_id": user_id, "email": email})
    except jwt.ExpiredSignatureError:
        return jsonify({"error": "Token has expired"}), 401
    except jwt.InvalidTokenError:
        return jsonify({"error": "Invalid token"}), 401

def validate_user(username, password):
    return {"id": 123, "email": "[email protected]", "role": "user"}

Benefits

• Stateless & Scalable: No server-side session store needed. Servers don't share state.
• Horizontal Scaling: Any server can validate any token (just needs the public key).
• Cross-Domain Friendly: Works seamlessly with CORS and different domains.
• Mobile-Friendly: Perfect for native mobile apps (no cookie support needed).
• Performance: No database lookup on every request.

Drawbacks

• Difficult Revocation: Can't invalidate a token before expiration (need blacklist or short TTL).
• Token Size: JWTs are larger than session IDs (100-500 bytes vs 16-32 bytes).
• No Server Control: Can't update token claims mid-session (user must re-login).
• Storage Security: If stored in localStorage, vulnerable to XSS. If in cookies, need CSRF protection.

Detailed Comparison

A comprehensive comparison across key dimensions to guide your authentication strategy.

Refresh Tokens (Hybrid Approach)

The best of both worlds: short-lived access tokens + long-lived refresh tokens.

How It Works

To mitigate JWT revocation issues, use a dual-token system:

• Access Token (JWT): Short TTL (5-15 minutes). Used for API requests. Stateless validation.
• Refresh Token: Long TTL (days/weeks). Stored server-side. Used to issue new access tokens.

Refresh Token Implementation

import uuid
from datetime import datetime, timedelta

# Store refresh tokens in database
refresh_tokens_db = {}  # In production: use Redis or database

@app.route('/login', methods=['POST'])
def login():
    user = validate_user(request.json['username'], request.json['password'])
    if not user:
        return jsonify({"error": "Invalid credentials"}), 401
    
    # Short-lived access token (15 minutes)
    access_payload = {
        "sub": user['id'],
        "email": user['email'],
        "exp": datetime.utcnow() + timedelta(minutes=15)
    }
    access_token = jwt.encode(access_payload, SECRET_KEY, algorithm="HS256")
    
    # Long-lived refresh token (7 days)
    refresh_token_id = str(uuid.uuid4())
    refresh_tokens_db[refresh_token_id] = {
        "user_id": user['id'],
        "expires_at": datetime.utcnow() + timedelta(days=7)
    }
    
    return jsonify({
        "access_token": access_token,
        "refresh_token": refresh_token_id,
        "expires_in": 900  # 15 minutes in seconds
    })

@app.route('/refresh', methods=['POST'])
def refresh():
    """Issue new access token using refresh token"""
    refresh_token = request.json.get('refresh_token')
    
    # Validate refresh token
    token_data = refresh_tokens_db.get(refresh_token)
    if not token_data:
        return jsonify({"error": "Invalid refresh token"}), 401
    
    if datetime.utcnow() > token_data['expires_at']:
        del refresh_tokens_db[refresh_token]  # Clean up expired token
        return jsonify({"error": "Refresh token expired"}), 401
    
    # Issue new access token
    user_id = token_data['user_id']
    access_payload = {
        "sub": user_id,
        "exp": datetime.utcnow() + timedelta(minutes=15)
    }
    access_token = jwt.encode(access_payload, SECRET_KEY, algorithm="HS256")
    
    return jsonify({
        "access_token": access_token,
        "expires_in": 900
    })

@app.route('/logout', methods=['POST'])
def logout():
    """Revoke refresh token"""
    refresh_token = request.json.get('refresh_token')
    if refresh_token in refresh_tokens_db:
        del refresh_tokens_db[refresh_token]
    return jsonify({"message": "Logged out"})

Decision Guide: When to Use Each

Hybrid Approach (Recommended)

For most modern applications, use JWT access tokens (short TTL) + refresh tokens (server-side stored):

• Combines stateless scalability of JWTs for most requests
• Maintains server control via refresh token revocation
• Balances performance, security, and user experience