Sessions vs tokens
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
compare the two common ways to stay logged in.
Planned topics
- Session: after login the server stores state and gives the client a session ID, usually in a cookie. Each request sends it back.
- Token: after login the server gives a signed token (for example a JWT) that the client sends in
Authorization: Bearer .... The server verifies it without stored state. - Sessions are simple to revoke but need shared storage when you run several instances.
- Tokens scale easily across instances but are harder to revoke before they expire.
- Browser apps often use cookie sessions; mobile apps and APIs often use tokens. JNR-P5 implements them.
Draft outline details
Demonstration
Session: Cookie: JSESSIONID=abc123
Token: Authorization: Bearer eyJhbGciOi...Check your understanding
Which approach keeps state on the server?
Show answer
Sessions.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.