mediumBackend

What is the difference between JWT and session-based authentication, and where do refresh tokens fit?

Q: What is the difference between JWT and session-based authentication, and where do refresh tokens fit?

**TL;DR.** **Session auth** stores state server-side and gives the client an opaque **cookie id** (look up the session each request). **JWT auth** is **stateless** — a signed token carries the claims and is verified without a DB lookup, but is hard to revoke. **Short-lived access tokens** + a stored, **rotating refresh token** balance statelessness with revocability. session cookie = opaque id state on server (store) easy to revoke <

384 views

Understand the problem

Stateless tokens vs server-side sessions and token rotation.

nodejssecurityjwtauth

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Access + refresh token issue/rotate

import jwt from 'jsonwebtoken';

// short-lived access token (stateless)
const access = jwt.sign({ sub: user.id, roles: user.roles }, SECRET, { expiresIn: '10m' });

// long-lived refresh token: store a hash server-side so it's revocable + rotatable
const refresh = crypto.randomUUID();
await db.saveRefresh({ userId: user.id, hash: sha256(refresh) });

res.cookie('rt', refresh, { httpOnly: true, secure: true, sameSite: 'strict' });

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

What is PM2 and what does it add over running `node server.js` directly?

How can you debug a Node.js application?