System Design · Middle · Question 12 of 75
What is the main drawback of stateless JWTs compared to server-side sessions?
- ✓Correct answer: An issued token is hard to revoke before it expires
- 2JWTs can't be sent in HTTP headers
- 3JWTs can't store a user identifier
Explanation
The server verifies the signature without hitting the DB, which is convenient for scaling. But if a user is banned or a token is stolen, it keeps working. Solutions: short-lived access tokens, rotating refresh tokens, a revocation list (which partially brings state back).