JWT versus server session: how do you choose for a Spring Boot monolith that will scale out?
PICTURE THIS: A SENTENCE BECOMES TOKENS
The model does not read letters like humans. It reads these pieces, then predicts the next one.
Simple meaning
Sessions need a shared store such as Redis once you have more than one app instance, or sticky load balancing which you should avoid.
WHY — Auth instead of guessing?
Why interviewers care about Auth:
contrast on Auth, not two memorised paragraphs.
the developer, then one case where picking wrong hurts.
Name the idea, why it exists, then one short example.
End with when you use it and one common pitfall.
STEPS — What happens with tokens?
Before the model can read a sentence, it goes through these steps:
- 1Sessions need a shared
store such as Redis once you have more than one app instance, or sticky load balancing which you should avoid.
- 2JWTs move state to
the client so any instance can verify the signature.
- 3JWTs are harder to
revoke instantly
- 4Context mix
sessions are easy to delete.
- 5Many teams use short-lived
JWTs plus a refresh token in a Redis allow-list.
- 6Decode
IDs turn back into readable text.
EXAMPLE — See it in action
Let's see how a real sentence is tokenized (tokens may vary by model):
Note: Actual tokens and IDs depend on the tokenizer (e.g., GPT, Llama, etc.).
Key takeaway
Sessions need a shared store such as Redis once you have more than one app instance, or sticky load balancing which you should avoid. JWTs move state to the client so any instance can verify the signature.