Default to server side sessions in an httpOnly, Secure, SameSite cookie, because you can revoke instantly and the client never holds anything sensitive. JWTs earn their place when services cannot share a session store and you need stateless verification. If you use them, keep access tokens short lived, pair them with a rotating refresh token, and accept that revoking before expiry requires a denylist you now maintain.
Why interviewers ask this
This is a judgement question dressed as a trivia question. The interviewer wants to hear a default with a reason, not a religious answer, and they are listening for whether you know the revocation problem and the storage problem. Candidates who say JWTs are more secure or who suggest localStorage usually have not run an auth system in production. Naming the tradeoff is worth more than picking a side.
How to structure your answer
- Give your default and the single reason for it.
- Name the condition that would change your mind.
- Explain the revocation problem with tokens.
- Cover where the credential is stored on the client.
Example answer
For a normal product with one backend, I start with server sessions. An opaque session id in an httpOnly cookie means the browser cannot read it, so an XSS bug does not immediately hand over an account, and logging someone out everywhere is a single row delete. That instant revocation is worth a lot the first time you have to lock a compromised account at two in the morning. I move to JWTs when there are several services that need to verify a caller without a shared store, or when a mobile client and a browser client hit the same API. Even then I keep access tokens to about fifteen minutes with a rotating refresh token, and I detect refresh reuse as a theft signal. What I do not do is put tokens in localStorage; if I need them in the browser, they go in an httpOnly cookie with SameSite set and CSRF protection on state changing requests. Statelessness is a real benefit, but people underestimate the cost of not being able to revoke.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you log a user out of every device with JWTs?
- Why is localStorage a bad place for a token?
- How does refresh token rotation detect a stolen token?
Related full stack developer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions