Compare cookie-session and JWT. Which would you pick?
Auth choice is a recurring system-design question — reveals whether you've thought about state, revocation, and XSS/CSRF exposure.
Server-side session: server stores session data (Redis), client holds only an opaque session id cookie. Revocation easy, but requires session store and sticky sessions or shared cache.
JWT: stateless token signed by server. No DB lookup per request — scales horizontally. Can't revoke until expiry (mitigation: short TTL + refresh token + denylist).
Storage: httpOnly+Secure cookie is XSS-safe but needs CSRF defense (SameSite=Lax/Strict or CSRF token). localStorage is XSS-exposed — any injected script reads it.
JWT payload is base64-encoded, NOT encrypted — don't put secrets in it. Use JWE if you need encryption.
Typical 2026 pattern: short-lived access JWT (15 min) + long-lived refresh token in httpOnly cookie.
For an internal monolith I pick server-side sessions in Redis — revocation is one DEL command, and the cookie is tiny. For a microservices or multi-region setup I go JWT because there's no shared session store to coordinate. In either case I put the token in an httpOnly+Secure+SameSite=Lax cookie, never localStorage — any XSS gets your token otherwise. JWT's biggest gotcha is revocation: you can't "log someone out" instantly unless you keep a denylist, which defeats the "stateless" sales pitch. My standard pattern is 15-minute access JWT + 7-day refresh in an httpOnly cookie, with refresh rotation on each use so a stolen refresh token is a one-shot weapon.
Never store JWT in localStorage if you can avoid it — XSS becomes game over.
SameSite=Lax is the sensible CSRF default in 2026 (most browsers default this now).
HireMe AI (即答侠) maps the question to "state vs scaling vs revocation" so you answer structurally instead of listing trivia.
Not natively. You either wait for expiry, maintain a denylist (reintroducing state), or rotate signing keys (revokes everyone).
No. OAuth is an authorization protocol; JWT is a token format. OAuth often uses JWTs as access tokens but can use opaque tokens too.
HireMe AI listens to your interview in real-time, detects questions, and generates instant answer suggestions — so you never freeze up again.
Try HireMe AI Free