In this lesson, you will learn how to distinguish between the persistent, server-heavy nature of cookie-based authentication and the portable, stateless efficiency of JWT-based authentication.
The Shift from Stateful to Stateless
Up until now, you have likely worked with Cookie Authentication. In that model, the server maintains "state": when a user logs in, the server creates a session in memory or a database and sends a cookie back to the browser. Every subsequent request includes that cookie, which the server uses to look up the user's session data. This is stateful because the server must remember who the user is for the duration of the session.
Token-Based Authentication (typically using JSON Web Tokens, or JWT) flips this model. Instead of storing session information on the server, the server issues a digitally signed, self-contained token to the client.
How It Works
When the client receives the JWT, it stores it (usually in localStorage or memory). For every API request, the client attaches this token in the Authorization header:
Authorization: Bearer <your-jwt-token>
Because the token contains the user's claims (like their ID and roles) and is cryptographically signed by your server, the server doesn't need to look up a database or memory cache to verify the user. It simply validates the signature of the token. If the signature is valid, the server trusts the information inside.
The Core Difference
- Cookie Authentication (Stateful): The server holds the "truth" in a session store. It is easier to revoke access (you just delete the session) but can become a bottleneck as the number of concurrent users grows, especially in distributed systems.
- Token-Based Authentication (Stateless): The token holds the "truth." The server is free to handle requests from any client without needing a central session repository, making it ideal for microservices and mobile APIs. However, revoking a token before it naturally expires is significantly more complex because the server does not "know" the token exists until it arrives.
Key Takeaway: While cookie authentication relies on server-side session persistence to identify users, token-based authentication offloads identity verification to a self-contained, signed packet of data, enabling stateless scalability at the cost of immediate session revocation.