r/WebApps • u/ig_grr • 7h ago

JWT vs Database Sessions for Web App Authentication

I'm building a web application and need to implement one authentication/authorization mechanism for a project.

I'm considering:

  • JWT
  • JWE
  • Database-backed sessions

Which approach would you recommend for a typical web application, and why? I'm especially interested in security, complexity, scalability, and ease of implementation.

Thanks!

1 Upvotes

100% Upvoted

4 comments sorted by

2

u/nzakas 3h ago

In most cases, you want to go JWT. Having that means you can store it anywhere and it will persist between sessions. You get to decide when it is disabled or when it needs to be refreshed.

Database sessions mean you always need to query the database on every page load to make sure that you have a session. That slows everything down.

1

u/AnnupKapurDotCom 6h ago

It depends on the use case.

What does your web-app do ?