Blog

When building web applications, choosing the right authentication method is crucial for security and user experience. JWT, Sessions, and OAuth are three popular approaches—but they solve different problems and work in different ways.

In this article, we'll explore what each method is, when to use them, and how they compare with practical examples.

🔐 What is session-based authentication?

Session-based authentication is the traditional approach where the server stores user information and creates a session after login.

How it works:

User logs in with credentials
Server creates a session and stores it (in memory, database, or cache)
Server sends a session ID to the client via cookies
Client sends the session ID with each request
Server validates the session ID and retrieves user data

// Server-side session creation (Node.js/Express)
app.post('/login', (req, res) => {
  const { username, password } = req.body;

  // Validate credentials
  if (isValidUser(username, password)) {
    // Create session
    req.session.userId = user.id;
    req.session.username = user.username;

    res.json({ message: 'Login successful' });
  }
});

// Protected route
app.get('/profile', (req, res) => {
  if (req.session.userId) {
    res.json({ user: req.session.username });
  } else {
    res.status(401).json({ error: 'Not authenticated' });
  }
});

Pros	Cons
Simple to implement and understand	Server must store session data (memory/storage overhead)
Server has full control over sessions	Doesn't scale well across multiple servers
Easy to revoke access instantly	Less suitable for mobile apps and APIs
Works well for traditional web apps	Vulnerable to CSRF attacks if not properly secured

🎟️ What is JWT (JSON web token)?

JWT is a stateless authentication method where user information is encoded in a token that the client stores and sends with each request.

A JWT contains three parts:

Header: Token type and signing algorithm
Payload: User data and claims
Signature: Verification signature

// Server-side JWT creation
const jwt = require('jsonwebtoken');

app.post('/login', (req, res) => {
  const { username, password } = req.body;

  if (isValidUser(username, password)) {
    // Create JWT token
    const token = jwt.sign(
      {
        userId: user.id,
        username: user.username
      },
      process.env.JWT_SECRET,
      { expiresIn: '24h' }
    );

    res.json({ token });
  }
});

// JWT verification middleware
const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: 'Access denied' });
  }

  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) {
      return res.status(403).json({ error: 'Invalid token' });
    }
    req.user = user;
    next();
  });
};

// Protected route
app.get('/profile', authenticateToken, (req, res) => {
  res.json({ user: req.user });
});

Pros	Cons
Stateless - no server-side storage needed	Cannot revoke tokens easily before expiration
Scales well across multiple servers	Tokens can become large with lots of data
Perfect for APIs and mobile apps	Vulnerable if token is compromised
Contains user data in the token itself	Requires careful secret key management
Cross-domain friendly

☁️ What is OAuth?

OAuth is an authorization framework that lets users grant third-party applications access to their resources without sharing passwords.

OAuth is commonly used for:

"Login with Google/Facebook/GitHub"
API access delegation
Third-party app permissions

// Step 1: Redirect to OAuth provider
app.get('/auth/google', (req, res) => {
  const googleAuthUrl = `https://accounts.google.com/oauth/authorize?` +
    `client_id=${process.env.GOOGLE_CLIENT_ID}&` +
    `redirect_uri=${process.env.REDIRECT_URI}&` +
    `scope=profile email&` +
    `response_type=code`;

  res.redirect(googleAuthUrl);
});

// Step 2: Handle OAuth callback
app.get('/auth/google/callback', async (req, res) => {
  const { code } = req.query;

  // Exchange code for access token
  const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      client_id: process.env.GOOGLE_CLIENT_ID,
      client_secret: process.env.GOOGLE_CLIENT_SECRET,
      code,
      grant_type: 'authorization_code',
      redirect_uri: process.env.REDIRECT_URI
    })
  });

  const { access_token } = await tokenResponse.json();

  // Get user info with access token
  const userResponse = await fetch(`https://www.googleapis.com/oauth2/v2/userinfo?access_token=${access_token}`);
  const user = await userResponse.json();

  // Create session or JWT for your app
  req.session.user = user;
  res.redirect('/dashboard');
});

Pros	Cons
No password storage required	Complex implementation
Leverages existing user accounts	Dependent on external providers
Granular permission scopes	Requires internet connectivity
Secure delegation of access	Additional security considerations
Industry standard for third-party integration	User experience can be inconsistent

🔄 How they work together

These methods aren't mutually exclusive. Many applications combine them:

OAuth + JWT Example:

// After OAuth login, create JWT for your app
app.get('/auth/google/callback', async (req, res) => {
  // ... OAuth flow ...

  // Create JWT after successful OAuth
  const token = jwt.sign(
    {
      userId: user.id,
      email: user.email,
      provider: 'google'
    },
    process.env.JWT_SECRET,
    { expiresIn: '7d' }
  );

  res.json({ token, user });
});

OAuth + Sessions Example:

// Store OAuth user in session
app.get('/auth/github/callback', async (req, res) => {
  // ... OAuth flow ...

  // Store in session after OAuth
  req.session.user = {
    id: user.id,
    username: user.login,
    provider: 'github'
  };

  res.redirect('/dashboard');
});

🎯 When to Use Each Method

Use Case	Best Method	Why
Traditional web app	Sessions	Simple, secure, full server control
REST API	JWT	Stateless, scalable, mobile-friendly
Mobile app	JWT	No cookies, easy token storage
Microservices	JWT	Stateless, no shared session store
Third-party login	OAuth	Secure, no password handling
Social media integration	OAuth	Access user's external data
Enterprise SSO	OAuth/SAML	Centralized identity management

🛡️ Security best practices

For Sessions:

// Secure session configuration
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production', // HTTPS only
    httpOnly: true, // Prevent XSS
    maxAge: 24 * 60 * 60 * 1000 // 24 hours
  }
}));

For JWT:

// Secure JWT practices
const token = jwt.sign(
  payload,
  process.env.JWT_SECRET, // Strong secret key
  {
    expiresIn: '15m', // Short expiration
    issuer: 'your-app',
    audience: 'your-users'
  }
);

// Implement refresh tokens
const refreshToken = jwt.sign(
  { userId: user.id },
  process.env.REFRESH_SECRET,
  { expiresIn: '7d' }
);

For OAuth:

// Validate state parameter to prevent CSRF
const state = crypto.randomBytes(32).toString('hex');
req.session.oauthState = state;

const authUrl = `${authEndpoint}?state=${state}&...`;

🔧 Implementation Checklist

Sessions:

✅ Configure secure session store (Redis/Database)

✅ Set secure cookie options

✅ Implement CSRF protection

✅ Handle session cleanup/expiration

JWT:

✅ Use strong secret keys

✅ Implement token refresh mechanism

✅ Set appropriate expiration times

✅ Store tokens securely on client

OAuth:

✅ Register app with OAuth provider

✅ Implement state parameter validation

✅ Handle error cases and edge scenarios

✅ Secure client secrets

📊 Performance comparison

Method	Server Load	Scalability	Network Overhead	Complexity
Sessions	High (session storage)	Limited	Low	Low
JWT	Low (stateless)	Excellent	Medium	Medium
OAuth	Variable	Good	High	High

🧠 Conclusion

Sessions work best for traditional web apps, JWT excels for APIs and mobile apps, and OAuth is essential for third-party integrations. Many modern applications combine these methods—like using OAuth for login and JWT for API access. Choose based on your specific needs, but always prioritize security regardless of your choice.