Node.js · Authentication · Fresh / Intern · Comparison
Session cookies vs JWT in Node APIs — trade-offs?
Short Interview Answer
Sessions: server-side revocation easy, sticky/store needed; JWT: stateless verification, harder revocation, size/claims care.
Detailed Explanation
Prefer httpOnly Secure SameSite cookies for browsers. Don't store sensitive data in JWT payloads. Rotate secrets/keys.