2 min lesson
JWT vs sessions and the pitfalls
Answer this: "A teammate argues for pure stateless JWTs with no refresh tokens and a 24-hour expiry, 'because it scales.' What's the reliability and security problem and what would you propose instead?"
Step 1 of 2
This is where interviewers find out whether you have the "strong opinions on reliability and performance" the JD asks for. The JWT-versus-session decision is a tax you pay on every single request at the consumer scale this role designs for.
The core tension is stated in one line: JWTs are stateless and verify locally, so they scale beautifully, but you cannot easily un-issue one before it expires. Server-side sessions revoke instantly, because the truth lives in your store, but every request pays a lookup.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Step each dimension to see which side wins it - and why production ships a blend of the two.