JWT vs session-based decision in Spring Boot - Quick Revision & Key Differences

Recall & Review

beginner

What is a JSON Web Token (JWT)?

A JWT is a compact, URL-safe token that securely transmits information between parties as a JSON object. It is often used for stateless authentication.

beginner

How does session-based authentication work in Spring Boot?

Session-based authentication stores user data on the server side and tracks the user with a session ID stored in a cookie on the client side.

intermediate

What is a key advantage of JWT over session-based authentication?

JWT is stateless, meaning the server does not need to store session data, which helps with scalability and reduces server memory use.

intermediate

What is a main security concern with JWT?

If a JWT is stolen, it can be used until it expires because it is self-contained and does not require server-side invalidation.

intermediate

When might session-based authentication be preferred over JWT?

When you want easier control over user logout and session invalidation, or when your app is mostly server-rendered and stateful.

Which authentication method stores user data on the server?

A Session-based authentication

B JWT authentication

C OAuth 2.0

D API key authentication

Session-based authentication keeps user data on the server, tracked by a session ID.

What is a benefit of JWT being stateless?

A Easier to invalidate tokens immediately

B No need to store session data on the server

C Requires less client storage

D Automatically encrypts user data

JWT tokens carry all info needed, so the server does not store session data.

What is a common risk when using JWT?

A Tokens can be used until expiration if stolen

B Server memory overload

C Requires cookies to work

D Does not support mobile apps

If a JWT is stolen, it remains valid until it expires, posing a security risk.

Which method allows easy server-side logout?

A Basic authentication

B JWT authentication

C Session-based authentication

D Token-based authentication

Session-based authentication allows the server to invalidate sessions immediately.

Which is true about JWT tokens?

A They always expire after 1 hour

B They require server-side storage

C They cannot be used in REST APIs

D They are self-contained and include user info

JWT tokens carry user info inside the token itself, making them self-contained.

Explain the main differences between JWT and session-based authentication in Spring Boot.

Think about where user data is stored and how logout works.

Describe scenarios where you would choose JWT over session-based authentication and vice versa.

Consider app type and control over user sessions.