跪拜 Guibai
← All articles
Frontend · Backend · Interview

Session-Cookie, JWT, and SSO: How Web Authentication Actually Works

By Wilson王艺谋 ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Choosing between sessions and tokens isn't a matter of fashion; it determines how you handle logout, scale across servers, and defend against XSS versus CSRF. Getting the combination wrong — JWT without a refresh-and-blacklist strategy, or sessions without shared Redis in a distributed deployment — creates outages and security gaps that only surface in production.

Summary

HTTP has no memory, so every authentication scheme is a workaround for that fact. Session-Cookie keeps user state on the server and hands the browser a short-lived ID; JWT packs user claims into a signed token the client carries around; SSO layers a central authority on top so one login unlocks multiple systems. Each approach shifts the trade-offs between server load, revocation control, cross-domain support, and attack surface.

The guide walks through the mechanics with sequence diagrams and TypeScript snippets: Express sessions backed by Redis, JWT issuance and refresh-token rotation, and CAS/OAuth redirect flows. A comparison table lines up token size, scalability, logout difficulty, and the specific attack each scheme is most vulnerable to — CSRF for sessions, XSS for JWTs stored in localStorage.

A decision flowchart and scenario table close the loop. Monoliths still favor Session-Cookie for simplicity and instant kick capability. Microservices and mobile apps lean toward JWT for stateless verification. Multi-system enterprise setups need SSO, implemented via shared cookies on the same domain or CAS/OAuth across domains. The underlying authentication mechanism — session or JWT — is independent of the SSO architecture sitting above it.

Takeaways
Session-Cookie stores user state server-side and exchanges a small session ID via HttpOnly cookies; the server can revoke access instantly by deleting the session.
JWT encodes user claims in a self-contained token verified by signature, eliminating server-side lookups but making immediate invalidation impossible without a blacklist.
JWT stored in localStorage is vulnerable to XSS; using HttpOnly cookies for JWT mitigates this but reintroduces CSRF concerns that the Authorization header naturally avoids.
A dual-token pattern — short-lived access token (15 minutes) plus long-lived refresh token (7 days) — lets JWTs expire frequently while keeping users logged in.
SSO is an architectural layer, not an authentication mechanism: it can be built on top of either sessions or JWTs, using shared cookies for same-domain systems or CAS/OAuth for cross-domain.
OAuth 2.0 is an authorization protocol, not an authentication protocol; OIDC adds an identity layer on top of OAuth 2.0 to make it suitable for login.
Distributed Session-Cookie deployments require shared Redis or sticky sessions; JWT avoids this entirely because any server can verify the token locally.
CSRF attacks target Session-Cookie setups because browsers automatically attach cookies to requests; SameSite cookies and CSRF tokens are the standard defenses.
Conclusions

JWT's 'stateless' label is misleading in practice — the moment you need logout or token revocation, you reintroduce server-side state through a blacklist or token version field, eroding the very advantage that justified choosing JWT.

The security model flips depending on where the token lives: Authorization headers protect against CSRF but expose the token to JavaScript; HttpOnly cookies protect against XSS but require CSRF mitigation. There is no single safe storage location, only a choice of which attack class to prioritize defending against.

SSO implementations often conflate authentication and authorization layers. CAS is a pure authentication protocol; OAuth 2.0 was designed for delegated authorization and only becomes an authentication solution when paired with OIDC. Misunderstanding this distinction leads to over-permissioned third-party integrations.

The guide's decision flowchart correctly identifies 'need instant kick' as the pivot point for JWT versus Session-Cookie, but many teams underestimate how often that requirement emerges — compliance, security incidents, and user de-provisioning all demand it.

Concepts & terms
JWT (JSON Web Token)
A compact, URL-safe token consisting of three Base64-encoded parts — header, payload, and signature — used to transmit claims between parties. The signature ensures integrity; anyone holding the secret can verify the token hasn't been tampered with.
Session-Cookie
A stateful authentication pattern where the server creates a session record (stored in memory or Redis) and sends the client a session ID as a cookie. Subsequent requests include the cookie, and the server looks up the corresponding session to identify the user.
SSO (Single Sign-On)
An authentication scheme that allows a user to log in once and gain access to multiple independent systems without re-entering credentials. Implemented via protocols like CAS, OAuth 2.0/OIDC, or SAML, with a central identity provider vouching for the user.
CAS (Central Authentication Service)
A single sign-on protocol for web applications where a central CAS server handles authentication and issues service tickets. Client applications never see the user's credentials; they validate tickets with the CAS server to establish a local session.
OIDC (OpenID Connect)
An identity layer built on top of OAuth 2.0 that adds authentication capabilities. It introduces an ID token (a JWT) containing user identity claims, making OAuth 2.0 suitable for login scenarios rather than just delegated authorization.
CSRF (Cross-Site Request Forgery)
An attack that tricks a user's browser into making unwanted requests to a site where they're authenticated, exploiting the fact that cookies are automatically attached. Defenses include CSRF tokens, SameSite cookies, and custom request headers.
Refresh Token Rotation
A JWT pattern where a short-lived access token is paired with a longer-lived refresh token. When the access token expires, the client presents the refresh token to obtain a new access token, often also receiving a new refresh token and invalidating the old one.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗