Engineering Decisions · Middle · Question 10 of 14
A web app talks to its own API on the same domain. Support must be able to end a stolen session immediately. How do you handle sessions?
- 1Stateless JWTs with a 15-minute lifetime
- 2Server sessions with an
HttpOnlycookie - 3Long-lived JWTs stored in
localStorage
Show the answer
Correct answer: Server sessions with an HttpOnly cookie
Explanation
With sessions on the server, deleting the record ends access at once, and an HttpOnly cookie stays out of reach of scripts. JWTs in localStorage fit almost nothing here: an XSS bug can read them, and they can't be revoked. Short-lived JWTs fit many independent services that verify tokens on their own, but a stolen token stays valid until it expires, unless you add a revocation list.