How do session-based and token-based authentication compare?

Both approaches identify a caller, but they differ in where the authority lives. With sessions, the server looks up the session record on every request. With tokens, the server verifies a signature and trusts the claims. The first is easy to revoke; the second is easy to scale.

app.use(
  session({
    store: new RedisStore({ client: redis }),
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
      httpOnly: true,
      secure: true,
      sameSite: "lax",
      maxAge: 1000 * 60 * 60 * 8,
    },
  }),
);

Trade-offs

• Sessions require a shared store such as Redis or a sticky load balancer
• Session revocation is immediate: delete the record
• Tokens avoid a lookup per request but cannot be revoked without extra state
• Cookies need CSRF protection for state-changing requests
• Mobile and third-party clients often prefer bearer tokens
• Both need HTTPS, rotation, short lifetimes and secure cookie flags where applicable

A hybrid is common: an opaque session cookie for the browser, plus short-lived access tokens for service-to-service calls. The important question is not which is modern, but where revocation, scale and client type push the complexity. If you need instant logout across devices, server-side state is a feature.