JWT vs Sessions: Auth Architecture Guide (2026)

Q: Are JWTs better than sessions?

Neither is better; they optimize different constraints, and the framing "modern vs legacy" has caused a decade of avoidable incidents. Server-side sessions keep all state on the server — the client holds only an opaque identifier in a cookie — which makes revocation instant (delete the row), leaks nothing in the credential itself, and has well-worn defenses for its known attacks. Their cost is a session-store lookup on every request (roughly a millisecond against Redis) and shared state that every service in a distributed system must reach. JWTs invert the trade: the client carries signed claims that any service verifies locally with a public key — no lookup, no shared store, which is exactly what microservice fan-out and third-party API access need — but the token is a bearer instrument valid until expiry, so revocation requires reintroducing state (denylists, short lifetimes, tracked refresh tokens). The decision question is concrete: can your architecture afford a revocation check round-trip on every request? A monolith or small service count answers yes — use sessions, they are simpler and safer by default. Twenty services behind a gateway answer no — use short-lived JWTs, and handle the revocation gap deliberately with the access/refresh hybrid rather than pretending it does not exist.

Q: Why should tokens never be stored in localStorage?

Because localStorage is fully readable by any JavaScript running on your page, and that includes the attacker's JavaScript after any cross-site-scripting (XSS) vulnerability — in your code, or in any of the hundreds of npm packages and third-party scripts your app loads. One injected script tag anywhere in that supply chain executes document.localStorage reads, ships your users' tokens to an attacker's server, and converts a cosmetic XSS bug into full account takeover at scale; with long-lived JWTs the stolen tokens keep working for days regardless of the user changing their password. The fix is storage the JavaScript runtime cannot touch: cookies flagged httpOnly (invisible to scripts), Secure (HTTPS only), and SameSite=Lax or Strict (which also neutralizes most CSRF, the attack cookies are traditionally feared for — and what remains is handled by standard CSRF tokens or the fact that modern SameSite defaults cover it). This applies identically to JWTs and session IDs — the debate about token type is orthogonal to the storage rule. The awkward corner is single-page apps calling third-party APIs from the browser: the answer there is the backend-for-frontend pattern (your server holds the tokens, the browser holds only a session cookie to your server) rather than accepting localStorage risk. No convenience justifies script-readable credentials.

Q: How do refresh tokens and rotation work?

The refresh token is the stateful anchor that makes short-lived stateless access tokens livable. At login the server issues a pair: an access JWT that expires in minutes and a refresh token — long-lived, but recorded server-side against the user and device. The client uses the access token for every API call (verified statelessly, no store lookup); when it expires, the client presents the refresh token to one endpoint, which checks the server record — is it valid, unexpired, unrevoked? — and issues a fresh pair. Rotation is the security upgrade that should be considered mandatory: every refresh redemption also issues a NEW refresh token and invalidates the presented one, so refresh tokens are single-use. The payoff is reuse detection: if an already-consumed refresh token is ever presented again, two parties are holding tokens from the same family — the legitimate client and a thief — and the server cannot tell which is which, so it revokes the entire family, forcing re-authentication and cutting the attacker off. This detection converts silent long-term compromise into a visible, self-healing event. Store refresh tokens with the same httpOnly-cookie discipline as everything else, scope them to the refresh endpoint path, and you have sessions-grade control (instant revocation, device listing, log-out-everywhere) at one server touch per access-token lifetime instead of per request.

Q: How long should JWT access tokens live?

Five to fifteen minutes for user-facing access tokens, and the reasoning is that expiry is your primary revocation mechanism for a stateless credential. A JWT is valid until it expires — no server-side check happens on ordinary requests — so the token lifetime IS the maximum window during which a stolen token, a fired employee, or a banned account keeps working. At 10 minutes, your worst-case unauthorized-access window after any revocation event is 10 minutes, which most threat models can absorb; at the 24-hour or 7-day lifetimes that tutorials casually mint, you have built a credential you cannot recall for a week, which no threat model absorbs. The cost of short expiry is more refresh-endpoint traffic — one redemption per user per token lifetime — which is trivial next to per-request session lookups and is precisely what the refresh-token layer exists to amortize. Adjust by sensitivity: machine-to-machine tokens inside a trusted cluster can run shorter still (60 seconds is common with workload identity, since issuance is automated); tokens carrying elevated privileges (admin scopes, payment operations) should sit at the bottom of the range or require step-up authentication per operation. If short lifetimes feel painful, the pain is telling you the refresh flow is missing or broken — fix that rather than lengthening the bearer window.

Q: How do you revoke a JWT before it expires?

You reintroduce exactly as much state as the job requires — the honest admission at the heart of stateless auth. The layered approach: first, keep access tokens so short-lived (5-15 minutes) that most revocation needs are satisfied by simply not issuing the next one — ban the user, revoke their refresh token server-side, and their access dies at the next expiry, minutes away. Second, for the cases that cannot wait minutes — active incident, compromised admin account — maintain a denylist of revoked token IDs (the jti claim) that services check; kept small by only holding entries until their natural expiry, it fits in a fast cache and costs one Redis-class lookup, and you can scope the check to sensitive operations only if even that bothers you. Third, the nuclear option: rotate the signing key, instantly invalidating every outstanding token from that key — correct for a key-compromise event, disruptive (all users re-authenticate) for anything less. Version-stamping tokens with a per-user counter (bump the counter to invalidate all of a user's tokens) is a lighter variant worth having. The design rule: decide the revocation story before shipping, because retrofitting it during an incident is how "we'll just wait for expiry" becomes an executive briefing.

Q: What are the classic JWT security vulnerabilities?

The infamous ones are all variations of a single sin: the server trusting the token's own header to decide how to verify the token. The alg:none attack — CVE-lore at this point — exploited libraries that honored a token declaring algorithm "none," accepting unsigned tokens as valid; an attacker just edits the payload and strips the signature. The RS256-to-HS256 key-confusion attack is subtler: the attacker takes a token from a server using asymmetric RS256, changes the header to symmetric HS256, and signs it with the server's PUBLIC key — libraries that dispatched on the header then verified it with that same public key as if it were the HMAC secret, validating a forged token. Both are fixed in maintained libraries and both still appear in hand-rolled verification and unmaintained dependencies. The defenses are mechanical: pin the exact algorithm list your server accepts in server-side configuration and reject everything else regardless of header; use maintained, audited JWT libraries and keep them current; validate every claim that matters — expiry, issuer, and critically audience, so a token minted for service A is rejected by service B; and prefer asymmetric signing so verification keys cannot forge. Round it out with real key management — kid headers, JWKS publication, rotation drills — and the classic attack surface is closed.

Q: What should services use to authenticate to each other?

Short-lived JWTs from a workload-identity system — never long-lived shared secrets pasted into environment variables. The pattern: each service has an identity established by the platform (Kubernetes service accounts with OIDC federation, SPIFFE/SPIRE, or cloud-provider workload identity), and obtains tokens automatically — typically minute-scale lifetimes — asserting "I am service A" to whoever needs proof; receiving services verify against the issuer's published public keys, locally, with no shared secret anywhere. This is JWT territory without controversy because the revocation objection evaporates: tokens that expire in 60 seconds and are re-issued automatically by machinery have no meaningful revocation gap, while the stateless-verification benefit is exactly what high-QPS service fan-out needs. The rules that keep it sound: separate audiences per target service so tokens are not fungible across the cluster; scopes narrow enough that a compromised low-privilege service cannot use its token against the payment service; asymmetric keys so verifiers cannot mint; and mTLS underneath where the mesh provides it, giving transport-level identity in addition to token-level. The 2026 addition is AI agents and automations as callers: they get the same treatment — scoped-down, short-lived, audience-restricted tokens per task, with server-side authorization on every request — because an agent holding a broad user token is a confused-deputy incident waiting for a prompt injection.

Q: Do I even need to build auth myself in 2026?

For most products, no — and the build-vs-buy line is worth drawing precisely. Managed identity providers (Auth0/Okta, Clerk, Supabase Auth, Firebase Auth, AWS Cognito, or self-hosted Keycloak/Ory) deliver the entire hard surface — password hashing, MFA, OAuth social login, session/token lifecycle, rotation, breach-password checks, anomaly detection — for a per-active-user price that is almost always cheaper than the engineering time to build and, more importantly, to maintain and patch the same surface for years. Authentication is the worst possible place to learn from your own mistakes, because the failure mode is a breach, not a bug ticket. Build in-house when you have a genuine reason: extreme scale where per-user pricing breaks (millions of MAU), sovereignty or air-gap requirements no vendor satisfies, or auth-adjacent product features that ARE your differentiation. Even then, "build" should mean composing audited primitives — argon2/bcrypt, maintained JWT libraries, the patterns in this article — never inventing cryptography or token formats. And regardless of buy or build, the architecture in this article remains YOUR responsibility: where tokens are stored (httpOnly cookies), how long they live, what the revocation story is, and how services verify — a managed provider hands you good defaults, but the integration decisions are where deployments go right or wrong.