Contents
The main difference between a session and a cookie is that session data is stored on the server, whereas cookies store data in the visitor’s browser. Sessions are more secure than cookies as it is stored in server.
Cookies are set by the server and sent in requests in very specific ways. JWT on the other hand is exclusively a medium, it is an assertion of some facts in a particular structure.
What’s the difference between cookie based and token based authentication?
“Cookie based authentication”. I find that this usually means “Session id, send by cookie, possible as plain text.” “Token based authentication”. Usually this means “Claims, send using the authentication header, encoded as a Json Web Token.” “Claims based authentication”. Could be anything but a session id.
The biggest disadvantage of token authentication is the size of JWTs. A session cookie is relatively tiny compared to even the smallest JWT. Depending on your use case, the size of the token could become problematic if you add many claims to it.
A session cookie is relatively tiny compared to even the smallest JWT. Depending on your use case, the size of the token could become problematic if you add many claims to it. Remember, each request to the server must include the JWT along with it. Where to Store Tokens? With token-based auth, you are given the choice of where to store the JWT.
What’s the difference between a session ID and claim?
A session id. This means that the server has a session storage which contains the active sessions. Sessions are stateful on the server side. A set of claims. Claims contain information on what operations the client may perform. The server does not keep track of each authenticated client, but trusts the claims.