Authentication - lesson 3 | HackIndia Skills

Key point

Main choice

Use sessions for most server-rendered web apps. Use tokens when your API must be called by separate clients like a mobile app, another backend, or a separate frontend domain.

The real question is simple: where will you store the signed-in state, and how will you revoke it when the user logs out?

What sessions mean

With sessions, the server stores the login state. The browser only keeps a random session ID, usually in a cookie.

On each request, the server reads the session ID, looks it up, and knows the user. Logout is easy because the server can delete that session.

What tokens mean

With tokens, the client stores a signed token. The server checks the token on each request and trusts its contents if the signature is valid.

Tokens are common for APIs and mobile apps. Logout is harder because a valid token can remain valid until it expires, unless you add a denylist or use short expiry with refresh tokens.

Your to-do

Choose by app shape

Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.

Pick sessions if your backend serves your pages or your frontend and backend share one site.
Pick sessions if you want simple logout and easier server-side control.
Pick tokens if you are building an API used by a mobile app, CLI, or multiple services.
Pick tokens if your frontend and backend are clearly separate and cookie-based sessions are awkward.
Write the reason in your README so a reviewer can inspect your thinking.

0 of 5 done

Common mistake

Do not use JWTs only because they sound more advanced. A JWT is not automatically safer than a session.

Also do not store long-lived tokens in localStorage without thinking through theft by injected JavaScript. You will handle storage details in the cookie lesson, but your choice starts here.

Example

README note

Add a small section like this to your repo. It tells a recruiter that you made an auth design choice, not just copied a package setup.

Auth choice

This app uses server-side sessions.

Reason:
- The app is a normal web app with browser users.
- The backend can store and revoke sessions.
- Logout deletes the server session, so access stops immediately.
- The browser only receives a session id, not the user password or user record.

Security checks:
- Passwords are hashed before storage.
- Protected pages check the session before returning user data.
- Session cookie settings are documented in the cookie section.

Tip

Ask AI well

AI can help you compare choices, but give it your app shape. Ask for risks, not just code.

Check the answer for three things: where state is stored, how expiry works, and how logout or revocation works.

Prompt:
I am building a web app with Express and React for college event registrations.
Users sign in from a browser. The backend and frontend are on the same domain in production.
Should I use server-side sessions or JWT access tokens?
Compare storage, logout, expiry, and what I should write in my README.