Authentication is one of the most important parts of modern web applications. Whenever users log in to an application, the server needs a way to identify and remember them during future requests.

Different authentication approaches solve this problem differently.

The three most common concepts are:

• Sessions

• Cookies

• JWT (JSON Web Tokens)

Understanding how they work helps developers choose the right authentication strategy for different applications.

What are Cookies?

Cookies are small pieces of data stored in the browser.

The server sends cookies to the client, and the browser automatically includes them in future requests.

Example Flow

1. User logs in

2. Server sends cookie

3. Browser stores cookie

4. Browser sends cookie with every request

Cookie Example

res.cookie("username", "Aman");

Cookies themselves are not authentication systems.

They are simply a storage mechanism.

Sessions and JWTs often use cookies internally.

What are Sessions?

Sessions are a server-side authentication mechanism.

After login:

1. The server creates a session

2. Session data is stored on the server

3. A session ID is sent to the browser using a cookie

4. Future requests use the session ID to identify the user

Session Authentication Flow

User Login
↓
Server Creates Session
↓
Session Stored on Server
↓
Session ID Sent via Cookie
↓
Browser Sends Cookie in Future Requests
↓
Server Verifies Session

Example Session Setup (Express)

const session = require("express-session");

app.use(session({
  secret: "secret-key",
  resave: false,
  saveUninitialized: true
}));

What are JWT Tokens?

JWT stands for:

JSON Web Token

JWT is a token-based authentication system.

Instead of storing user session data on the server:

• The server generates a signed token

• The client stores the token

• The client sends the token with future requests

• The server verifies the token

JWT Authentication Flow

User Login
↓
Server Generates JWT
↓
Client Stores Token
↓
Client Sends Token with Requests
↓
Server Verifies JWT
↓
Access Granted

Example JWT Creation

const jwt = require("jsonwebtoken");

const token = jwt.sign({
  userId: 1
}, "secret-key");

Stateful vs Stateless Authentication

Stateful Authentication

Sessions are stateful.

This means:

• Server stores authentication state

• Server remembers logged-in users

Stateless Authentication

JWT authentication is stateless.

This means:

• Server does not store user session data

• Token itself contains authentication information

Sessions vs JWT Comparison

Sessions vs JWT vs Cookies

When to Use Sessions

Sessions are useful when:

• Building traditional web apps

• Managing authentication centrally

• Simpler logout handling is needed

• Server-side control is preferred

Common Examples

• Admin dashboards

• Internal company tools

• Traditional MVC applications

When to Use JWT

JWT works best when:

• Building APIs

• Creating mobile applications

• Supporting multiple frontend clients

• Building scalable distributed systems

Common Examples

• Mobile apps

• SPA applications

• Microservices

• REST APIs

Real-World Analogy

Session Authentication

Like receiving a hotel room card.

The hotel stores your details internally and identifies you using the card number.

JWT Authentication

Like carrying a signed identity card.

Your identity information is inside the card itself.

Why Developers Compare Sessions and JWT

Both approaches solve the same authentication problem differently.

The choice depends on:

• Application architecture

• Scalability needs

• Frontend type

• Deployment strategy

There is no universal “best” solution.

Key Takeaways

• Cookies store small browser data

• Sessions store authentication state on the server

• JWT stores authentication information inside tokens

• Sessions are stateful

• JWT is stateless

• Both approaches are widely used in modern applications

Conclusion

Sessions, JWTs, and cookies are foundational concepts in web authentication. Understanding how each works helps developers design authentication systems that match their application requirements.

Sessions provide centralized control, while JWT offers scalability and flexibility for modern APIs and distributed systems.

Final Tip

Do not think of cookies, sessions, and JWT as competing technologies.

Instead:

• Cookies are storage mechanisms

• Sessions are server-managed authentication

• JWT is token-based authentication

Understanding that distinction makes authentication much easier to reason about.