Blog/NotesConcept

Explained Web Authorization Techniques - Session & JWT

Understand important web authorization techniques to enhance role-based authentication for any web application with popular techniques like Session & JSON Web Token (JWT)

Intermediate

Anuj Sharma

Last Updated Nov 14, 2025

Authorization is about validating the user's permission to access the resources, in case of failure HTTP code "403 Forbidden" is returned.

Authorization Techniques

There are 2 major techniques for authorization, here are the details

1. Session-based authorizations - using Session Id

Authorization flow

The client sends a username & password to the server. The server validates credentials against existing credentials stored in the DB
On successful authentication server generates a unique session ID (signed) and stores session_id on the server.
The server sends back session_id which will be set as part of a cookie in the browser.
```
HTTP OK 200 set-cookie
```
All subsequent HTTP calls include session_id and request as part of the COOKIE request header.
The server validates session_id as part of the cookie against the stored cookie if valid then authorize the user to process that HTTP request.

Major drawbacks

Hard to load balance - Since this is a stateful mechanism, it requires the server to store the session ID, but in the case of multiple servers, this session is invalidated if the request is routed to another server by an API gateway or load balancer.

💡Solution - The above problem can be solved using common caching like Redis where all the servers will store and access session_id from Redis cache.
Prone to CSRF attacks - Session-based authentications are prone to CSRF attacks. This can be prevented by using the X-CSRF-Token header.
Access cookie by client-side application - Cookies can be accessed by any client-side application that can use the Cookie details to create a new session programmatically.
💡Solution - Cookies can be secured using HTTP-Only, same-origin options along with a Set-Cookie header so that it can't be accessible through JavaScript code.

2. Token-based authorization (Stateless) - JWT token

Authorization flow

The client sends a username & password to the server. The server validates credentials against existing credentials stored in the DB.
On successful authentication server generates a unique JWT Token, which contains data(payload) related to the user and signs that token.
This Token is sent back to the user as part of a successful HTTP response with the Authentication HTTP header
```
HTTP 200 OK Authentication: Bearer [Token]
```
Users save this token in a cookie or local storage
The user sends this token along with API requests in subsequent requests as part of the Authentication header.
The server validates the JWT token by decoding information from the JWT token. If the token is valid then the server authenticates that token and processes the API request.

Major drawbacks

Secret must be shared between servers so that the server can extract the user details.
In case of invalid Tokens(forgot password), requires a list of invalid tokens which makes a more sort of stateful kind.
Token-based authentications are prone to XSS attacks.
The token is not opaque and contains payload information, and this can be extracted from the token.
No sensitive information can be mentioned as part of the payload.
The generation of a new signature is essential a frequent intervals to avoid Resource Forgery attacks

🚀

Love this content? Share it!

Help others discover this resource

Comments

1 comment

Very helpful to understand web Authorization.

Share Your Expertise & Help the Community!

Build Your Portfolio

Help the Community

Strengthen Your Skills

Share your knowledge by writing a blog or quick notes. Your contribution can help thousands of frontend developers ace their interviews and grow their careers! 🚀

Other Related Blogs

Anuj Sharma

Last Updated Nov 10, 2025

Find the top React Performance Optimization Techniques specific to React applications that help to make your react app faster and more responsive for the users along with some bonus techniques.

Anuj Sharma

Last Updated Nov 10, 2025

Find the step-by-step explanation of the useFetch custom hook in React that helps in fetching the data from an API and handling loading, error states.

Anuj Sharma

Last Updated Nov 11, 2025

Understand step by step how to flatten nested array in javascript using recursion, also explore the flatten of complex array of object.

Anuj Sharma

Last Updated Nov 16, 2025

Implement useThrottle Custom Hook In React (Interview) to limit the number of APi calls to improve the performance of application.

Anuj Sharma

Last Updated Oct 2, 2025

Explore Polyfill for map, filter and reduce array methods in JavaScript. A detailed explanation of Map, filter and reduce polyfills in JS helps you to know the internal working of these array methods.

Alok Kumar Giri

Last Updated Jun 2, 2025

Code snippet examples which will help to grasp the concept of Hoisting in JavaScript, with solutions to understand how it works behind the scene.

Explained Web Authorization Techniques - Session & JWT

Authorization Techniques

1. Session-based authorizations - using Session Id

2. Token-based authorization (Stateless) - JWT token

Love this content? Share it!

Comments

Share Your Expertise & Help the Community!

Other Related Blogs

Top 10 React Performance Optimization Techniques [React Interview]

Implement useFetch() Custom Hook in React (Interview)

Flatten Nested Array in JavaScript using Recursion

Implement useThrottle Custom Hook In React (Interview)

Polyfill for map, filter, and reduce in JavaScript

Master Hoisting in JavaScript with 5 Examples

Stay Updated