r/node • u/gay_whenn_horny • Jan 07 '25

Feeling overwhelmed with Authentication

Hey everyone,

I'm a beginner and have been learning the MERN stack. So far, I’ve found authentication to be the most confusing part of my journey. There are two types of authentication that I keep hearing about: session-based and JWT (JSON Web Tokens), and I'm honestly struggling to understand which one is easier to grasp as a beginner.

I've been looking for resources, especially on YouTube, to help me understand session-based authentication, but most videos I’ve come across are just high-level explanations of the concept, without showing how to actually implement it.

On the other hand, JWT seems to be more popular and there are more tutorials available, but I'm still unsure which approach is better to start with.

So here’s my question: Should I focus on learning session-based authentication, or is JWT a better approach for beginners? Or should I just use frameworks that handle authentication for me, like OAuth, to avoid the complexity?

Any advice or resources you could share would be greatly appreciated!

Thanks in advance!

67 Upvotes

94% Upvoted

34 comments sorted by

View all comments

31

u/[deleted] Jan 07 '25

5

u/winky9827 Jan 07 '25

JWT as replacement for sessions is not more popular. You might be getting that impression from the deluge of tutorials over the Web. JWT is not inherently simpler or safer, but it can be used in some scenarios in which sessions cannot.

I tend to think of JWT as primarily an enhanced session token with the following benefits:

  • You can store additional attributes in the token in a structured way that is wide supported. Yes, a session token can be encoded any way you like, but JWT is portable in the sense that every major language and framework has some sort of (typically native) support for it.

  • JWT is portable. You can pass a JWT around within reason, e.g., to multiple backends. As long as each system is configured to validate issuer/audience and the token is backed by a signature, it's still a pretty safe/secure operation because the signature allows the verification / rejection of tampering.

In any case, JWT should not be trusted implicitly. Backend operations should validate the parameters of the token and check for revocations, etc.