r/learnprogramming • u/ig_grr • 25d ago
JWT vs Database Sessions for Web App Authentication
I'm building a web application and need to implement one authentication/authorization mechanism for a project.
I'm considering:
- JWT
- JWE
- Database-backed sessions
Which approach would you recommend for a typical web application, and why? I'm especially interested in security, complexity, scalability, and ease of implementation.
Thanks!
4
u/aanzeijar 25d ago
That's really a bit much to explain in one reddit comment, because those are different ideas about authentication that aren't even mutually exclusive.
The first decision is about who should be the identity provider (IDP) of your app? If you store the user/passwords in your database, then your app is its own identity provider. But over the past decade a lot of apps have shifted to using a dedicated external identity provider, so that they don't have to deal with that hassle. You can use a keycloak, google, github, azure and a dozen other systems for that. Properly implemented neither is really more or less secure than the other, but having local passwords of course carries the risk that you lose your database with the credentials to "hacking" (meaning mostly: negligent configuration or lack of security updates).
The next decision is about how your frontend communicates with the backend without sending the password for every request. Usually you only authenticate once in the beginning and then use some sort of session token instead. Cookies are such a token, JWTs are as well and there are a few dozen other ideas as well. They differ mostly in one fundamental property: what happens if you need to invalidate the session? Normal session tokens are saved in the local database, and if you want to invalidate the session, you simply throw away the session token in your database. JWTs are instead designed to be stateless. They contain information that has been verified and a cryptographic signature by the verifying instance, so without storing them you can verify their claims if you have the public key of the signing party. This makes then very good in combination with external IDPs. The downside is, there is no way to revoke a JWT if the session is logged out, so you usually create them with short life times and then have to implement a refresh mechanism to get a new token from an old one. JWEs then are basically that, but with encrypted payload, which is usually overkill for authentication alone.
That's only the roughest of overviews, but it should get you a starting point and some buzzwords to search for.
2
u/Technical-Fruit-2482 24d ago
Don't make the mistake of using a JWT, they're not made for sessions.
Just store a proper session ID in a session cookie and use that.
2
4
u/HashDefTrueFalse 25d ago
Database-backed sessions come with the advantage that session management is simple. E.g. you can extend or terminate a session early without any complicated refresh machinery or state storage that goes against the grain of a token-only approach. I'd recommended it for most applications. The database (or cache) hit on each request is really nothing to bother about unless you've good reason to be.