What are common authentication mechanisms (sessions, JWT, OAuth)?

Question

IT Interview Practice · Accepted Answer

Modern applications use various **authentication mechanisms** — session-based, token-based (JWT), and delegated authentication (OAuth/OpenID Connect). Understanding how each works, and their trade-offs, is important for implementing secure authentication.

## Session-based authentication

```text
SESSION-based (traditional):
  → user logs in → server creates a SESSION (stored server-side) → sends a session ID
    cookie → the browser sends it with each request → server looks up the session
  ✓ server controls sessions (easy to revoke); simple; cookie auto-sent
  ✗ stateful (server stores sessions); scaling needs shared session storage
```

## Token-based (JWT)

```text
JWT (JSON Web Token):
  → user logs in → server issues a SIGNED token containing claims (user id, etc.) →
    client stores it → sends it (usually in an Authorization header) per request →
    server VERIFIES the SIGNATURE (no server-side lookup needed)
  ✓ STATELESS (scales easily; no session store); works well for APIs/SPAs/mobile
  ✗ hard to REVOKE before expiry (it's self-contained) → use short expiry + refresh tokens
  ⚠️ store securely; don't put secrets in the (readable) payload; validate properly
```

## OAuth 2.0 / OpenID Connect

```text
OAUTH 2.0 → DELEGATED AUTHORIZATION ("Log in with Google/GitHub"):
  → let users authenticate via a third party without sharing their password with your app
  → your app gets a token to access permitted resources (scoped)
OPENID CONNECT (on top of OAuth) → adds AUTHENTICATION (identity) → standard for SSO/
  social login
→ delegate auth to trusted providers; users don't create another password.
```

## Why it matters

Understanding common authentication mechanisms is important because **authentication is fundamental to most applications**, and choosing and implementing it correctly affects security and architecture, so it's valuable knowledge.

The main mechanisms each have characteristics and trade-offs. **Session-based authentication** (server-side sessions with a session-ID cookie) gives the server control over sessions (easy revocation) but is stateful (requiring shared session storage to scale). **JWT (token-based)** authentication (signed self-contained tokens verified without server lookup) is **stateless** (scaling easily, working well for APIs, SPAs, and mobile) but has the notable trade-off that **tokens are hard to revoke before expiry** (since they're self-contained, requiring short expiry plus refresh tokens) and must be stored securely with no secrets in the readable payload — understanding these JWT considerations is important since JWTs are common but commonly misused. **OAuth 2.0 and OpenID Connect** (delegated authentication — "Log in with Google/GitHub") let users authenticate via trusted third parties without sharing passwords with your app, the standard for SSO and social login.

Understanding these mechanisms, how they work, and their **trade-offs** (session statefulness and easy revocation vs JWT statelessness and revocation difficulty; OAuth for delegated auth) is important for choosing the right approach (sessions for traditional web apps with server control, JWT for stateless APIs, OAuth for delegated/social login) and implementing it securely.

Authentication is fundamental, and getting it right (correct mechanism, secure implementation) is critical for security.

Since authentication is fundamental to most applications and the mechanisms (sessions, JWT, OAuth) have important differences and trade-offs affecting security and architecture, and since understanding them is necessary for implementing authentication correctly, understanding common authentication mechanisms is valuable, practically-relevant security knowledge — important for the fundamental need of authentication, enabling sound choices among sessions, JWT, and OAuth and their secure implementation, a key topic for building secure applications with proper authentication.

Session-based authentication

Token-based (JWT)

OAuth 2.0 / OpenID Connect

Why it matters

Related questions