JWT vs session strategy in NextJS - Quick Revision & Key Differences

Recall & Review

beginner

What is a JWT (JSON Web Token)?

A JWT is a compact, URL-safe token that securely transmits information between parties as a JSON object. It is often used for stateless authentication in web apps.

beginner

How does session-based authentication work?

Session-based authentication stores user data on the server after login. The server creates a session ID and sends it to the client as a cookie. The client sends this cookie with requests to prove identity.

intermediate

What is one main advantage of JWT over sessions?

JWTs are stateless, meaning the server does not need to store session data. This makes scaling easier because any server can verify the token without shared storage.

intermediate

What is a key security concern with JWTs compared to sessions?

JWTs are stored on the client side, often in localStorage or cookies, which can be vulnerable to theft via XSS attacks. Sessions keep sensitive data on the server, reducing this risk.

intermediate

When might you prefer session strategy over JWT in Next.js apps?

Use sessions when you want simple, secure authentication with server-side control, especially if you need to easily revoke access or store complex user data securely.

Which of these is true about JWT?

A It stores user data on the client and is stateless.

B It requires server-side storage for each user session.

C It cannot be used in Next.js apps.

D It automatically encrypts user passwords.

JWTs store data on the client and do not require server-side session storage.

What does a session ID cookie do?

A Encrypts the user's password.

B Stores the entire user profile on the client.

C Identifies the user session on the server.

D Expires immediately after login.

The session ID cookie tells the server which session data belongs to the user.

Which is a security risk specific to JWTs?

A Server overload from storing sessions.

B XSS attacks stealing tokens from client storage.

C Cookies being sent automatically with requests.

D Sessions timing out too quickly.

JWTs stored on the client can be stolen by malicious scripts via XSS.

Why might sessions be easier to revoke than JWTs?

A Sessions do not use cookies.

B JWTs expire instantly after logout.

C JWTs are encrypted and cannot be revoked.

D Sessions are stored on the server and can be deleted anytime.

Since sessions live on the server, the server can delete them to revoke access immediately.

In Next.js, which strategy is better for scaling across many servers?

A JWT strategy because it is stateless.

B Session strategy without shared storage.

C Session strategy with local server storage only.

D Neither can scale well.

JWTs are stateless and do not require shared session storage, making scaling easier.

Explain the main differences between JWT and session strategies for authentication.

Think about where data is stored and how that affects security and scaling.

Describe a scenario in a Next.js app where you would choose sessions over JWTs.

Consider security and control needs.