Lesson 6.1 · 25 min

Auth: sessions, JWT and OAuth 2

Revoke a stolen login and watch a session die while a JWT keeps working, tamper with a real token, and step through OAuth 2 with PKCE.

The idea in plain words

A hotel gives you a key card at the desk. The door checks the card, not your passport, and the desk can cancel a card at any time. Logging in works the same way: prove who you are once, then carry something the servers can check quickly.

The problem it solves

Every request to your API has to answer two questions: who is calling, and are they allowed to do this? Asking for a password on every request is impossible, so after one sign-in the caller needs something the servers can check quickly, and that you can take back.

How it works

1. The user signs in once, usually through a provider such as Google, using OAuth 2 with PKCE.
2. The server then either stores a session and gives the browser a cookie, or hands out a signed token (a JWT).
3. A session is checked by looking it up; logging out deletes it, so it stops at once.
4. A JWT is checked by its signature, with no lookup, but it stays valid until it expires.
5. So tokens are kept short (minutes) and renewed with a refresh token that the server can cancel.

Example

A banking app uses 5-minute access tokens. A phone is stolen at 10:02 and support revokes the refresh token. The thief’s token works until 10:05 at the latest, then every renewal is refused.

Key terms

Authentication

Proving who is calling, for example by signing in.

Authorization

Deciding what that caller is allowed to do.

Session

A record on the server that says "this cookie belongs to this user"; deleting it logs them out.

JWT

A signed token that carries claims such as the user id and an expiry time; servers check the signature instead of looking it up.

OAuth 2 / OIDC

The standard way to let an app get tokens from a sign-in provider; OIDC adds who the user is.

In this lesson you'll learn

• Choose between a session cookie and a JWT, and explain what revoking each really does.
• Walk through OAuth 2 authorization code with PKCE, and where OIDC fits.
• Decide where tokens are checked: gateway, every service, or the auth server.

Sections

1. Theory: revoke a stolen login
2. Theory: inside a JWT
3. Theory: OAuth 2 + PKCE
4. Design: say it in 60 s
5. Warm-up
6. Design review

Cheat sheet

The interactive simulations and the scored design review load with JavaScript.