JWTs vs Session Cookies Is the Wrong Debate

JWTs versus cookies is the wrong debate.

I’ve sat in too many meetings where teams argue over JWTs or session cookies like they’re mutually exclusive. Spoiler: they’re not. A JWT can live in a cookie. A session identifier can live in browser storage. The format isn’t the problem—it’s where you store it, how long it lasts, and whether you can revoke it when things go wrong.

Let’s reframe the conversation.

Cookies aren’t the opposite of JWTs. An HttpOnly cookie can carry a JWT just as easily as it can carry an opaque session ID. The real question is: what can the browser (or an attacker) do with it?

“Stateless” isn’t magic. If your server accepts a JWT until it expires, you’ve traded infrastructure simplicity for a revocation headache. Sure, you don’t need a session store, but now you need a way to invalidate tokens when an account is compromised. Short-lived access tokens with refresh tokens? Revocation lists? These aren’t free features.

HttpOnly is useful, not a silver bullet. It keeps browser scripts from reading your cookie, but it doesn’t stop cross-site scripting (XSS) or eliminate the need for CSRF protections. It’s one layer in a defense-in-depth strategy, not the whole strategy.

Here’s what actually matters:

• Where does the credential live? HttpOnly cookie? Local storage? Session storage? Each has trade-offs for exposure and automatic transmission.
• How long does it work? A long-lived token is convenient but risky. A short-lived token needs refresh logic. Pick a lifetime that aligns with your risk tolerance.
• What ends access? Logout should do more than clear the UI. Account compromise? Disabled user? You need a plan to revoke access immediately.
• What protects requests? HttpOnly and Secure flags are table stakes. CSRF tokens? SameSite cookies? Match the protections to the threat model.
• What can your team operate? A design that’s hard to monitor, explain, or maintain will fail in production.

I’ve seen teams adopt JWTs to avoid session stores, only to scramble when they realize revocation isn’t built in. I’ve seen others use cookies without understanding SameSite or Secure flags, leaving themselves open to trivial attacks.

The browser doesn’t care which acronym won your architecture debate. It cares about where the credential lives, how long it’s valid, and whether it’s protected in transit.

Before you pick a side in the JWT-versus-cookie wars, ask yourself: If an account is compromised today, how quickly can I cut off access?

That’s the question that matters.