Stateless Auth: JWT vs Server Sessions
Stateless Auth: JWT vs Server Sessions
MediumBackend0% accepted
Choose between JWT-based stateless auth and server-side sessions for a horizontally-scaled API. Explain the trade-offs. Cover: where state lives, how each scales across servers, the hard problem of revoking a JWT before it expires, refresh-token rotation, and where to store tokens in the browser safely.
Approach
Sessions store state server-side (easy revoke, needs shared store). JWTs are stateless and scale well but can't be revoked before expiry without a blocklist. Use short-lived access + rotating refresh tokens in HttpOnly cookies.
More Backend problems
Browse all coding problems →Scenarios & Expected Answers
No example scenarios for this problem.
Sign in to continue
Create a free account to view answers and mark progress.
- Free forever — no credit card
- Theory Q&A with detailed answers
- Points, streaks & leaderboards