When NOT to use a JWT

JWT Authentication Course · lesson 7 of 13 · 4 min read

JWTs became the default answer to a question many apps were not asking.

Open this lesson in the learning hub

Key points

  • For a normal server-rendered app with a session, a plain session cookie is simpler and revocable.
  • A session id is opaque and tiny; a JWT is hundreds of bytes sent on every single request.
  • JWTs earn their place when the validator cannot reach the issuer - separate services, other companies.
  • If you added a Redis denylist to make revocation work, you now have a session store with extra steps.
  • Ask what problem the token solves. If the answer is "everyone uses them", use a session.

Reach for a JWT when validator and issuer are separated. Otherwise a session is simpler and safer.

Where to store a token in a browser Tokens or sessions: which problem are you solving

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the JWT Authentication Course course, and every lesson in it is listed on the JWT Authentication Course contents page.