Session Storage SOP: JWT vs Server-Side

Session Storage SOP: JWT vs Server-Side
Stateless JWT vs server-side sessions for authenticated apps. Choose by revocation needs.

— Use server-side sessions when: you need instant logout-everywhere and per-session revocation. Killing a row ends the session now.
— Use JWT when: you need stateless scale across services and can tolerate tokens living until expiry.
— Never store long-lived JWTs in localStorage: XSS reads them. Use HttpOnly cookies for the session token.
— If you use JWT, keep access tokens short (5-15 min) with a revocable refresh token server-side: that buys back revocation.
— Verify: log a user out, confirm their old token is rejected, not just removed from the client.

Run this when you design auth.