Sessions vs JWT vs Hosted — Pick the Right Model
Auth Overview
A 4-minute tour of authentication patterns for Express. Pick the one that matches your app.
What you'll learn
- Compare session-based vs token-based auth
- Know when to outsource to a provider
- Pick an auth model for your app
Auth is where most security vulnerabilities live. Before writing code, pick a model.
Three Models
| Model | Where state lives | Best for |
|---|---|---|
| Sessions | Server (DB / Redis) | Server-rendered apps, traditional websites |
| JWT | The token itself | Stateless APIs, microservices, SPAs |
| Hosted | A provider (Clerk, Auth0, etc.) | ”I don’t want to roll auth” |
Sessions
The classic web pattern:
- User logs in
- Server creates a session row in Redis/DB
- Server sends back a cookie containing the session ID
- Each request, server looks up the session by ID
Pros: revocation is trivial (delete the row), session data can be rich, simple to reason about.
Cons: needs a session store, sticky session concerns if you don’t use a shared store.
JWT
A signed token that contains the user info:
- User logs in
- Server signs a JWT with
{ sub: userId, exp: ... } - Server sends it to the client
- Each request, client sends the JWT; server verifies the signature
Pros: stateless, scales horizontally, works across domains.
Cons: revoking is hard (token is valid until expiry), bigger than session IDs, easy to misconfigure (algorithm confusion, weak secrets).
Hosted
A provider handles login, signup, sessions, MFA, OAuth:
- Clerk — modern UI components, hosted
- Auth0 — enterprise standard
- Supabase Auth — bundled with Supabase
- Auth.js (NextAuth) — open-source, multi-framework
Your Express app verifies a token the provider issued. You write ~50 lines of integration code total.
Pros: skip auth entirely. MFA, password resets, OAuth for free. SOC2 / compliance simpler.
Cons: another vendor relationship, sometimes pricing.
Picking
- Server-rendered app: Sessions. Cookie-based, simple, works with browsers natively.
- SPA + Node API: JWT or Sessions with cookies. JWT for fully-stateless mobile + SPA. Cookies if same-domain.
- B2B / fast-moving startup: Hosted. Skip the whole problem.
- Microservices: JWT + an auth service. The token is the shared currency.
The rest of this chapter implements each pattern.
Sessions →