Technologies Coding Problems Bookmarks Learning Paths

Technologies Coding Problems Bookmarks Learning Paths

AI-powered interview preparation platform. Practice with curated questions, mock interviews, and personalized learning paths to crack your dream tech interview.

Quick Links

Technologies
Saved Questions
Pricing

Company

About Us
Contact Us

Legal

Privacy Policy
Terms of Use

© 2026 nextRound. All rights reserved.

How does it differ from using sessions? | Basics | JWT Interview Questions | NextRound.in

Questions

5 of 6

1JWT authorization pitfalls?

2Why JWT may be the wrong choice?

3Are Cookies Better Than JWT?

4What are the advantages of using JWTs?

5How does it differ from using sessions?

JWT

Implementations

05 / 06

How does it differ from using sessions?

Difficulty: 6/10

Stateless vs Stateful, Token Revocation, Security Tradeoffs

1
In a typical session flow, the browser sends a cookie containing a token, which is then matched at the server to some data which the server makes use of to authenticate the user.
2
In a JWT flow, the token itself contains the data. The server decodes the token to authenticate the user. No data is stored on the server.

Scenario Questions

0-2 years experience

1We have a simple React app and a Node backend. If we switch from standard cookie-based sessions to JWTs, where should we store the JWT on the client side to prevent XSS, and how does the backend verify it on each request?
2Imagine a user logs out of our app, but we are using stateless JWTs. If an attacker intercepted that JWT before logout, can they still use it? How would you handle a logout event in this setup?

2-5 years experience

Follow-up Questions

If we use a short-lived JWT with a sliding-window refresh token, where should the refresh token be stored securely?
How does the payload size of a JWT affect network performance at scale compared to a simple 32-character session ID?
If a user changes their password, how do we invalidate all active JWTs without maintaining a stateful database of blacklisted tokens?

Sharethis question

Share via WhatsApp, X, Facebook, LinkedIn or copy link. Open Graph preview enabled.

1Our team recently migrated from Redis-backed sessions to stateless JWTs to save on database roundtrips. However, our customer support team is complaining that they can no longer force-reset a compromised user's session immediately. How would you resolve this without completely reverting back to stateful sessions?
2We are building a mobile app and a web app that share the same backend. The web app is vulnerable to CSRF if we use cookies, but storing JWTs in localStorage exposes us to XSS. How would you design the token storage and transmission strategy for both platforms to balance these risks?

5-8 years experience

1We are scaling our microservices architecture to handle 100k requests per second. If we use stateless JWTs, we avoid hitting a central session store, but our JWTs have grown to 4KB due to user permissions metadata, causing significant network overhead. How would you redesign our authentication and authorization flow to address this?
2We need to implement a 'blocklist' or immediate revocation mechanism for compromised accounts in a high-throughput system using JWTs. How would you architect this so we don't end up re-introducing the exact same database bottleneck we tried to avoid by moving away from traditional sessions?

8+ years experience

1We are planning to migrate a legacy monolithic application with 10 million active users from a sticky-session, server-side state model to a decentralized microservices architecture. What is your strategy for migrating the authentication state without forcing all active users to log out, and how do you align the security teams on the trade-offs of stateless tokens?
2Our enterprise SaaS platform needs to support both standard user sessions and third-party API integrations. Some engineering teams are pushing for a unified JWT-only architecture, while others want to keep traditional sessions for the web app and API keys for integrations. How do you evaluate these architectural directions, and what standard would you establish for the organization?