What they're testing
Whether you see the actual trade-off, or believe JWTs are "more modern therefore better".
The short answer~30 seconds
Server-side sessions: instant revocation (delete the record), at the cost of a session-store read per request. A JWT is self-contained: no lookup, verified by signature — in exchange you CANNOT revoke it until it expires. The common resolution is very short-lived access tokens (5–15 minutes) plus a revocable long-lived refresh token. Worth saying plainly: once you keep a refresh-token revocation list you have server state again — that is a session, differing only in how often you check.
The long answer
The real reason to choose a JWT isn't performance but trust boundaries: when several independent services must verify identity without calling a central one, a signature lets each check locally. For a monolith talking to one database that benefit is zero and you inherit only the revocation problem.
On implementation, two classic holes worth remembering. Accepting alg: none — an unsigned token the library nonetheless treats as valid; prevent it by pinning the algorithm at verification rather than reading it from the header. And algorithm confusion between symmetric and asymmetric: an attacker takes your public RSA key and signs a token with HMAC using it, and a server that trusts the header verifies it successfully.
Where the token lives is a separate security decision. localStorage is readable by XSS; an HttpOnly cookie isn't, so an XSS can act as the user but can't exfiltrate the token. With cookies, add SameSite=Lax and Secure. People treat this as an implementation detail, but it determines the blast radius of a different vulnerability — which is exactly what the interviewer wants to hear.
What they'll ask next
?What is refresh token rotation?
Each use of a refresh token issues a new one and invalidates the old. If an old token is presented again, you know it was stolen (the legitimate holder would have replaced it) and can kill the whole session. It's theft detection with no extra device required.
?What belongs in a JWT payload?
As little as possible, and nothing secret — the payload is base64-encoded, not encrypted, and anyone can read it. Putting roles in the token is convenient and means a permission change only takes effect when the token expires.
These lose points
- Saying a JWT is "more secure than a session". It isn't — it's a different trade-off, and revocation is where it loses.
- A 30-day access token. If it leaks, the attacker has 30 days and you have no recourse.