Sessions vs JWTs: you are choosing how often you pay for state

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product.

Every app you have ever built had to answer the same question on every single request.

Who is this, and are they allowed to do this?

There are two popular answers.

Sessions, where the server remembers you. And JWTs, where the server hands you a signed note and promptly forgets you exist.

Sessions vs JWTs: you are choosing how often you pay for state

Related reading

Understanding JWT: How Servers Remember You Without Sessions

JWT vs Session Tokens | What’s the Difference and Which Should You Use?

Seven Ideas That Keep Distributed Systems From Falling Over

Too Many Req: A Bucket List Guide to Building a Rate Limiter

A self-hosted PR reviewer: you own the trigger, not a GitHub App

I pasted a production JWT into a random website. Then I read their privacy…