In the world of authentication today, session tokens and JSON Web Tokens (JWTs) are the two most popular ways to manage user sessions and maintain a user’s authentication state between calls. Impassioned debates pit these solutions against each other, but each has pros and cons worth evaluating. Depending on the needs of your application, it’s even worth considering using them together to get the best of both worlds.
The Main Differences Between Session Tokens and JWTs
To understand the differences between session tokens and JWTs, it’s helpful to look at their setup and their impact.
Setup
The biggest difference in how session tokens and JWTs are set up is in where and how a user’s authentication information is stored.
With session tokens, the user’s authentication state is stored in a server-side database as a record that includes a primary identifier for the session (typically a random string that is at least 128 bits long), an identifier for the user, the time the session started, the expiry of the session and, sometimes, additional contextual information like the IP address. Once stored in the database, the session identifier is sent back to the client to be stored as a cookie in the user’s browser.
With JWTs, the user’s authentication data is stored as a JSON object, client-side, as soon as it’s issued by the server. The object contains a header, a payload (where sensitive user information is stored) and a signature that’s created by combining the header and payload, and then hashed with a secret key to protect the user’s information.
Impact
You can also look at session tokens and JWTs based on performance and control.
Generally, JWTs win out based on performance: They enable faster authorization and more interoperability with external apps. But they demand more developer investment to address their security complexities and ensure that the right guardrails are in place to prevent vulnerabilities.
Session tokens, on the other hand, enable more control but introduce some latency. While they provide stronger guarantees that each individual request is authorized and is simpler to implement securely, their bottleneck on the server-side database validation comes with a latency overhead that might ruin the user experience for highly responsive applications.
While this framework can be helpful shorthand for summing up JWTs and session tokens, it falls into the trap of pitting security against performance, as if the two are mutually exclusive. But forward-thinking leaders in growth and security alike recognize that the best solutions leverage security to optimize user experience and accelerate product adoption and growth. One of the best ways to do that with session management is to combine JWTs and session tokens into a powerful hybrid.
Combining JWTs and Session Tokens
To date, there are a few different ways companies have combined session tokens and JWTs. One of the simplest ways is to return both a session_token and a JWT when a user starts a session. The session_token is a static value that is good for the lifetime of the session (stored server-side), while the JWT has its own, shorter-lived expiry.
In this setup, expired JWTs can be passed to the session API in order to retrieve a fresh JWT, and the servers ensure that the underlying session is still active before passing back a new JWT. If the user logs out, this revocation of access will take place within whatever token age you set for your JWT. In other words, you only call the server when the JWT expires or before granting access to particularly sensitive actions.
Configured this way, this approach to secession management greatly reduces the performance overhead while also protecting you and your end users from the risk of authorizing actions based on stale information. Instead of a tradeoff, JWTs and session tokens are leveraged together to optimize both security and performance.
Picking the Solution That’s Right for You
Despite new hybrid approaches like the one described above, there are still maximalists out there who will tell you that one approach is always superior. The truth, of course, is that every application is unique and the security and latency tradeoffs need to be evaluated in context.
Whether you pursue session tokens, JWTs or a hybrid solution like the one described above, the choice of session management really boils down to how you answer four key questions:
1. How sensitive is the information you’re storing?
An extremely security-conscious organization, like a bank or government agency, might want to just use session cookies to ensure that every single call is authorized at that exact moment. Choose your solution based on the risk and cost of a data breach weighed against the cost greater latency might have on your customers.
2. What are your ambitions for the scalability of your product?
As mentioned earlier, scaling is much easier with JWTs because no call needs to be made to the server to re-authenticate the session. If handling high-volume traffic is a must for your product, you need to have a plan in place to address potential latency issues.
3. Which modern features does your application rely on?
For many modern features like serverless computing, cross-domain functionality, mobile-specific, or single-page applications, JWTs are either preferred or required. Understanding which of these features your product uses will help you understand the session management tools available to you.
4. How important are performance and uptime to my end-users?
How quickly do I want to get up and running? For companies whose value proposition relies on a fast, smooth user experience (say, live gaming), JWTs may offer the kind of speed and response time they need. For other kinds of products where latency has less of an impact on their user experience, or where they want a guarantee of security with less initial investment, session tokens may provide the stability and assurance they require.
The Choice is Yours
While some die-hard loyalists may always insist on choosing between session tokens and JWTs, modern session management solutions are much more nuanced, so companies can optimize the performance and security requirements for their unique products. With the ability to switch between JWTs and session tokens as needed, there’s more choice now than ever.
