Session vs JWT

Posted Aug 15, 2026 · 11 views

Both answer one question — *who is this request from?* — and keep the answer in a different place.

Server sessions resolve identity with a lookup: the server holds a session record and hands the client an opaque ID. Revocation is instant, because deleting the row deletes the session. The cost is a lookup on every request and somewhere to keep the sessions.

JWTs resolve identity with a signature check: the server signs the claims and hands them over, so no lookup and no shared store. The token is then valid until it expires — and revoking one early means building exactly the lookup the token existed to avoid.

The animation follows one logout through both designs.