As asked
You are building auth for a new SaaS. Walk me through the choice between server-side sessions and JWTs, and explain when each is right.
Sample answer outline
Server-side sessions: a session ID cookie, state in a server store (Redis, database). Revocation is trivial (delete the row), payload stays small. Default choice for a monolithic app where the auth server and the application share a backend. JWTs: self-contained, stateless verification, scale well across services that cannot share a session store. The trap: revocation. A signed JWT remains valid until it expires unless you keep a revocation list (which defeats the statelessness). Use short access tokens with refresh tokens to bound the blast radius. Pick sessions unless you have a multi-service architecture or a specific reason to be stateless.
Expect these follow-ups
- How do you implement logout for a JWT-based system?
- When does the refresh token rotation pattern break?
- What changes if you add a mobile client to the mix?