JWT vs session-based decision in Spring Boot - Visual Side-by-Side Comparison

Concept Flow - JWT vs session-based decision

User logs in

↓

Decision: Use JWT or Session?

↓

JWT

↓

Create JWT

↓

Send JWT

↓

Client stores JWT

↓

Client sends JWT with requests

↓

Server verifies JWT

↓

Access granted or denied

↓

Logout or Expire

This flow shows how after login, the system chooses JWT or session, then creates and sends tokens, client stores and sends them back, and server verifies to allow access.

Execution Sample

Spring Boot

POST /login
if (useJWT) {
  create JWT token
  send token to client
} else {
  create session
  send session ID
}

This code decides on login whether to create a JWT or a session, then sends the appropriate token to the client.

Execution Table

Step	Action	Decision	Token Created	Token Sent	Client Stores	Server Stores	Verification on Request
1	User submits login	N/A	N/A	N/A	N/A	N/A	N/A
2	Check config for token type	Use JWT	JWT token created	JWT sent	JWT stored	No session stored	JWT verified
3	Client sends request with token	Use JWT	N/A	N/A	JWT sent with request	N/A	JWT verified
4	Access granted	Use JWT	N/A	N/A	N/A	N/A	JWT valid
5	User logs out or token expires	Use JWT	N/A	N/A	JWT removed	N/A	Access denied if token invalid
6	Check config for token type	Use Session	Session created	Session ID sent	Session ID stored	Session stored	Session checked
7	Client sends request with session ID	Use Session	N/A	N/A	Session ID sent with request	N/A	Session checked
8	Access granted	Use Session	N/A	N/A	N/A	N/A	Session valid
9	User logs out or session expires	Use Session	N/A	N/A	Session ID removed	Session removed	Access denied if session invalid

💡 Process ends when user logs out or token/session expires, denying further access.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	After Step 6	After Step 7	After Step 9
useJWT	true or false	true or false	true or false	true or false	true or false	true or false	true or false
token	null	JWT token or null	JWT token	null (removed)	null	null	null
sessionID	null	null	null	null	session ID or null	session ID	null (removed)
clientStorage	empty	JWT stored or empty	JWT sent with requests	JWT removed	Session ID stored or empty	Session ID sent	Session ID removed
serverStorage	empty	No session stored	No session stored	No session stored	Session stored	Session stored	Session removed

Key Moments - 3 Insights

Why does JWT not require server to store session data?

Because JWT contains all user info and is verified by signature, the server just checks the token validity (see execution_table rows 2 and 3).

How does session-based auth keep track of users?

The server stores session data linked to a session ID sent to the client, which the client sends back on requests (see execution_table rows 6 and 7).

What happens when a JWT expires compared to a session?

JWT becomes invalid and access is denied without server state change; session expiration requires server to remove session data (see execution_table rows 5 and 9).

Visual Quiz - 3 Questions

Look at the execution table, at which step does the client send the JWT with requests?

A Step 3

B Step 2

C Step 6

D Step 7

💡 Hint

Check the 'Client Stores' and 'Verification on Request' columns in execution_table row 3.

According to variable_tracker, what happens to the 'token' variable after step 5?

A It remains the same JWT token

B It is removed (null)

C It changes to a session ID

D It is stored on the server

💡 Hint

Look at the 'token' row and the value under 'After Step 5' in variable_tracker.

If the system uses session-based auth, at which step is the session ID sent to the client?

A Step 3

B Step 5

C Step 6

D Step 7

💡 Hint

Refer to execution_table row 6 under 'Token Sent' column.

Concept Snapshot

JWT vs Session Decision in Spring Boot:
- After login, decide: JWT or Session
- JWT: create token, send to client, client stores and sends with requests
- Session: create server session, send session ID, client sends ID with requests
- Server verifies token or session on each request
- Logout or expiry ends access
- JWT is stateless; Session requires server storage

Full Transcript

This visual execution shows the decision process between JWT and session-based authentication in Spring Boot. When a user logs in, the system decides whether to use JWT or session. If JWT is chosen, a token is created and sent to the client, who stores it and sends it with each request. The server verifies the token without storing session data. If session is chosen, the server creates a session and sends a session ID to the client, who sends it back with requests. The server stores session data and checks it on each request. Access is granted if verification passes. Logout or token/session expiry ends access. Variables like token and sessionID change accordingly during the process. Key confusions include why JWT is stateless, how sessions track users, and what happens on expiry. The quiz tests understanding of these steps and variable changes.