Security
Web Authentication Explained: JWT, OAuth, and Sessions Demystified
By Riazul Islam•
Summary: Authentication is confusing until it clicks. Here's the clear explanation I wish I had when I started - no jargon, just how it actually works.
## The Three Pillars of Web Authentication
Every time you log into a website, one of three things is happening behind the scenes. Let me explain each one like I'm explaining it to a friend.
### 1. Session-Based Authentication (The Classic)
**How it works:**
1. You send your username and password
2. Server checks them, creates a "session" (like a ticket)
3. Server sends back a session ID in a cookie
4. Every request after that includes this cookie
5. Server looks up the session to verify you
**Pros:** Simple, well-understood, easy to revoke
**Cons:** Requires server-side storage, harder to scale
### 2. JWT (JSON Web Tokens)
**How it works:**
1. You send your credentials
2. Server creates a signed token containing your info
3. Token is sent back to you
4. You include this token in every request
5. Server verifies the signature - no database lookup needed
**The structure:**
```
header.payload.signature
```
**Pros:** Stateless, scalable, works across services
**Cons:** Can't be easily revoked, token size
### 3. OAuth 2.0 (Sign in with Google/GitHub)
**How it works:**
1. User clicks "Sign in with Google"
2. Redirected to Google's login page
3. User authenticates with Google
4. Google sends an authorization code back
5. Your server exchanges the code for an access token
6. You use the token to get user info from Google
**Pros:** No password management, trusted providers
**Cons:** Complex flow, dependency on third parties
### Which Should You Use?
| Scenario | Recommendation |
| Simple web app | Session-based |
| API-first application | JWT |
| Mobile + Web | JWT |
| Social login | OAuth 2.0 |
| Enterprise | OAuth 2.0 + SAML |
### Security Best Practices
- Always use HTTPS
- Store tokens in HTTP-only cookies
- Implement refresh token rotation
- Set short expiration times for access tokens
- Hash passwords with bcrypt (cost factor 12+)
**Authentication is the front door to your application. Make it strong, but don't make it complicated.**