![ProgressiveCod2's tweet photo. I asked this question to 11 candidates and only 3 managed to answer:
“What’s the difference between Session-based authentication and JWTs?”
The rest of the candidates just dropped some basic keywords and got things mixed up.
But why did I ask this question?
Because the candidates mentioned about implementing Sessions and JWTs in their projects.
So it was a good follow-up question to judge their credibility.
In this case, the interviewer isn’t usually expecting a perfect answer unless it’s not an API Security Engineer opening or something like that.
But a basic understanding of these concepts can boost your chances.
Here are a few important points that can help you answer this question:
[1] Session-Based Authentication
In this approach, you store the session information in a database or session store and give a session ID to the user.
For the user, it’s similar to just getting the Ticket ID of their flight. All other details are stored in the airline’s database.
Here’s how it works:
- The user makes a login request and the frontend app sends the request to the backend server
- The backend creates a session using a secret key and stores the data in session storage
- Then, the server sends a cookie back to the client with the unique session ID
- The user makes a new request to view another page and the browser sends the session id along with it.
- The server verifies the user using this ID.
[2] JWT-based Authentication
In the JWT-based approach, you don’t store the session information in the session store.
The entire information is available within the token.
It’s like getting the flight ticket along with all the details available on the ticket but encrypted.
Here’s how it works:
- The user makes a login request and it goes to the backend server
- The backend server verifies the credentials and issues a JWT. The JWT is signed using a private key. No session storage is involved.
- The JWT is passed to the browser using a cookie.
For every subsequent request, the browser sends the cookie with the JWT
- The server verifies the JWT using the secret private key and extracts the user info.
[3] What’s the better approach - Session or JWTs?
In a general sense, you can give the favorite answer of every software engineer.
“It depends”
JWTs offer some cool benefits when compared to sessions such as:
- No separate storage
- Easier to scale the client and server
But JWTs also have some disadvantages:
- Invalidating a JWT is not easy. With session, you can simply delete them from the session store.
- The data in the JWT can become stale
- The JWTs aren’t exactly small when it comes to size
Ultimately, the choice depends on the security requirements of your application.
If you can confidently explain this much, you are already ahead of many candidates.
Of course, there can be several additional follow-up questions.
👉 So - have you used sessions or JWTs in your project? (Not an interview question)
And what other points do you think can be added to boost a candidate’s chances?](https://pbs.twimg.com/media/GEG4jr4a4AADa1Y.jpg)
Olivia
Online
📶 Tom Innocent
@Innosqo
Nigeria
Joined April 2011
1.4K Following
459 Followers
783 Posts
What Are the Biggest #DigitalTransformation Challenges Organizations Face?
by @antgrasso
#EmergingTech #Technology #Innovation #Tech
cc: @chr1sa @evankirstel @miketamir
Quantum computing may still be in its early stages, but its ability to simulate molecular behavior precisely is already making traditional trial-and-error approaches in drug and material research feel increasingly outdated.
Microblog @antgrasso #QuantumComputing #DrugDiscovery
Quantum computing offers a radically different way to approach complex scientific challenges, particularly in chemistry and pharmaceuticals.
By using qubits to process multiple possibilities simultaneously, researchers can simulate how molecules interact without relying on expensive and time-consuming lab experiments. This can accelerate drug discovery, enabling identification of viable compounds earlier in the development process.
In materials science, it can guide the design of new alloys or polymers with tailored properties.
However, current hardware and algorithm limitations mean that companies must still invest carefully and prepare for a long-term integration strategy.
#MaterialsScience #PharmaTech #DigitalTransformation
How can governments, companies and civil society achieve long-term energy security and sustainability?
Find out in the latest @wef white paper in collaboration with @Accenture.
https://t.co/tTFlF9bpc5
rt @wef
Download 263-page PDF — A Practical Introduction to #Python Programming: https://t.co/hlRvFldbSX
—————
#DataScience #DataScientists #Coding #ComputationalScience
Easily deploy real-time #AI #DeepLearning and #MachineLearning models at scale with @AbacusAI enterprise-class #ML Feature Store that provides security, governance, and high SLAs: https://t.co/3gNpzH2ojc
—————
#DataScience #EnterpriseAI #MLOps #SQL #BigData #DataStrategy #CDO
I asked this question to 11 candidates and only 3 managed to answer:
“What’s the difference between Session-based authentication and JWTs?”
The rest of the candidates just dropped some basic keywords and got things mixed up.
But why did I ask this question?
Because the candidates mentioned about implementing Sessions and JWTs in their projects.
So it was a good follow-up question to judge their credibility.
In this case, the interviewer isn’t usually expecting a perfect answer unless it’s not an API Security Engineer opening or something like that.
But a basic understanding of these concepts can boost your chances.
Here are a few important points that can help you answer this question:
[1] Session-Based Authentication
In this approach, you store the session information in a database or session store and give a session ID to the user.
For the user, it’s similar to just getting the Ticket ID of their flight. All other details are stored in the airline’s database.
Here’s how it works:
- The user makes a login request and the frontend app sends the request to the backend server
- The backend creates a session using a secret key and stores the data in session storage
- Then, the server sends a cookie back to the client with the unique session ID
- The user makes a new request to view another page and the browser sends the session id along with it.
- The server verifies the user using this ID.
[2] JWT-based Authentication
In the JWT-based approach, you don’t store the session information in the session store.
The entire information is available within the token.
It’s like getting the flight ticket along with all the details available on the ticket but encrypted.
Here’s how it works:
- The user makes a login request and it goes to the backend server
- The backend server verifies the credentials and issues a JWT. The JWT is signed using a private key. No session storage is involved.
- The JWT is passed to the browser using a cookie.
For every subsequent request, the browser sends the cookie with the JWT
- The server verifies the JWT using the secret private key and extracts the user info.
[3] What’s the better approach - Session or JWTs?
In a general sense, you can give the favorite answer of every software engineer.
“It depends”
JWTs offer some cool benefits when compared to sessions such as:
- No separate storage
- Easier to scale the client and server
But JWTs also have some disadvantages:
- Invalidating a JWT is not easy. With session, you can simply delete them from the session store.
- The data in the JWT can become stale
- The JWTs aren’t exactly small when it comes to size
Ultimately, the choice depends on the security requirements of your application.
If you can confidently explain this much, you are already ahead of many candidates.
Of course, there can be several additional follow-up questions.
👉 So - have you used sessions or JWTs in your project? (Not an interview question)
And what other points do you think can be added to boost a candidate’s chances?
![ProgressiveCod2's tweet photo. I asked this question to 11 candidates and only 3 managed to answer:
“What’s the difference between Session-based authentication and JWTs?”
The rest of the candidates just dropped some basic keywords and got things mixed up.
But why did I ask this question?
Because the candidates mentioned about implementing Sessions and JWTs in their projects.
So it was a good follow-up question to judge their credibility.
In this case, the interviewer isn’t usually expecting a perfect answer unless it’s not an API Security Engineer opening or something like that.
But a basic understanding of these concepts can boost your chances.
Here are a few important points that can help you answer this question:
[1] Session-Based Authentication
In this approach, you store the session information in a database or session store and give a session ID to the user.
For the user, it’s similar to just getting the Ticket ID of their flight. All other details are stored in the airline’s database.
Here’s how it works:
- The user makes a login request and the frontend app sends the request to the backend server
- The backend creates a session using a secret key and stores the data in session storage
- Then, the server sends a cookie back to the client with the unique session ID
- The user makes a new request to view another page and the browser sends the session id along with it.
- The server verifies the user using this ID.
[2] JWT-based Authentication
In the JWT-based approach, you don’t store the session information in the session store.
The entire information is available within the token.
It’s like getting the flight ticket along with all the details available on the ticket but encrypted.
Here’s how it works:
- The user makes a login request and it goes to the backend server
- The backend server verifies the credentials and issues a JWT. The JWT is signed using a private key. No session storage is involved.
- The JWT is passed to the browser using a cookie.
For every subsequent request, the browser sends the cookie with the JWT
- The server verifies the JWT using the secret private key and extracts the user info.
[3] What’s the better approach - Session or JWTs?
In a general sense, you can give the favorite answer of every software engineer.
“It depends”
JWTs offer some cool benefits when compared to sessions such as:
- No separate storage
- Easier to scale the client and server
But JWTs also have some disadvantages:
- Invalidating a JWT is not easy. With session, you can simply delete them from the session store.
- The data in the JWT can become stale
- The JWTs aren’t exactly small when it comes to size
Ultimately, the choice depends on the security requirements of your application.
If you can confidently explain this much, you are already ahead of many candidates.
Of course, there can be several additional follow-up questions.
👉 So - have you used sessions or JWTs in your project? (Not an interview question)
And what other points do you think can be added to boost a candidate’s chances?](https://pbs.twimg.com/media/GEG4pUIa4AAGCuA.jpg)
Evolution of Communication Network Standards and Their Implications.
By @EverestGroup https://t.co/I3dYr6dmr7 @EverestGroup rt @antgrasso #5G #Network #IoT
Human Intelligence (HU) vs #ArtificialIntelligence (AI)
by @i_EcoRUSSIA @BBNTimes_en
Read more: https://t.co/8c1hsuoJW0
#BigData #MI #Digital #DataScience #MachineLearning
cc: @ronald_vanloon @bigdata @mikequindazzi
Gordon Moore, Intel Co-Founder, Dies at 94
He famously forecast in 1965 that the number of transistors on an integrated circuit would double every year – a prediction that later came to be known as Moore’s Law
https://t.co/ljGID0Luj4
#HPC
Internet of Things refers to objects and devices which interact with other people and objects by exchanging data - It's a rapidly emerging technology that is transforming our lives, and the applications are extensive. Infographic @Faranux @antgrasso rt @lindagrass0 #IoT
ESSENTIAL TIPS FOR BUILDING A CYBER RESILIENCE STRATEGY
Organizations, governments and smart cities should consider implementing a cyber resilience strategy.
Read more: https://t.co/4BZ73khTL9… via @BBNTimes_en
💡 2023 emerging AI and Machine Learning trends: https://t.co/AdT5ywKBZp vi @DataScienceDojo
#AI #MachineLearning #2023
Most Popular Users
Elon Musk 
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.1M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.8M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.3M followers
Virat Kohli
@imvkohli
73M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.1M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
62.9M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers