JWT pitfalls: when should you use JWTs vs server-side sessions?

Deep dive

JWTs are useful but have sharp edges:

• Good for stateless APIs and service-to-service with short TTL.
• Hard to revoke; use short-lived access tokens + refresh token rotation.
• Sessions (server-side) give central control, revocation, and MFA step-up.
• Store tokens in HttpOnly, SameSite cookies; avoid localStorage.

Examples

Session cookie approach:

Cookie: session_id=abc123 (HttpOnly, Secure, SameSite=Lax)
Server validates session in Redis and can revoke instantly

Common pitfalls

• Long-lived JWTs with sensitive claims.
• Storing JWTs in localStorage (XSS risk).
• Using JWTs when revocation is required (e.g., admin access).

Interview follow-ups

• How would you implement logout with JWTs?
• What claims should never be in a token?
• How do you rotate signing keys safely?