Token vs Session Authentication | Authentication Explained!!!

[@himankshu]

I love your teaching style. One thing if you add to make it cherry on the top is show real life examples

[@vishalpable9636]

Great explanation Piyush, I am thrilled to see this video because you explained it more clearly and easily understandable 👏

[@the-white-fang]

Interesting video. I do have a couple of questions though. The arguement of being token stolen seems like an unfair one since that could happen to cookies as well. Though there are some scenarios where sessions aren't just a valid answer for example mobile apps. Usually in mobile apps you can't really rely on sessions being persisted and can't expect the users to login in over and over again. On the other hand session based authentication works really well for the web apps. Ofcourse if you work in development professionally, you will need to implement both a lot of times with consistent behaviour. This is a good introduction for beginners though but it would be great if it was mentioned that there were more advanced forms of authentication methods and links to the documentation would have been a massive plus.

[@parikshitjagtap7633]

Awesome explanation.. One of the best video I ever seen for token and sessions..

[@suchanachakrabarti6783]

The Easiest explanation of all times!

[@yatendraupadhyay2180]

Bhai you deserve many more subscribers. Such a simple yet comprehensive explanation.

[@KirtanPatel552]

Mind Blowing Video Piyush sir....

[@ersouravkmr]

Lovely Lecture ❤❤ , Cleared All my doubts about Authetication Process , Token Vs Session Based , Stateless vs State fulll. Saw your another lecture on SSO. Cleared all doubts on that Topic also .

[@ashishsng]

I am saying this very honestly.. what a explanation!🔥🔥

[@2brothers346]

Keep continuing this hard work bro🔥🔥

[@piyushgargdev]

Thanks a lot 🎉

[@devlo57]

But token can only be generated when credentials are correct and it can only be leaked from user itself 🤔

[@roshanshah7364]

I think for improving security we can save the jwt token in cookies instead of local storage.

[@muditkhanna8164]

Very Effective explanation. but does server stores the secret key string in its database and the respective hash function, that means its still using memory for decoding the specific user from the token? i don't understand how can it be a advantage.

[@AniketSingh-nx4ds]

Its usually stored in config or environment variable, not database

[@utsavkumar4826]

serverless can be durable as well, such as azure durable functions

[@haristallat2201]

Perfectly explained, love from Pakistan

[@dharamved]

very helpful video and love your way of making any question easy to understand.

[@raushankumargupta7018]

Perfect explaination Piyush❤

[@harshshah2675]

Piyush sir thanks for this detailed explanation. It would be great if you could explain how to overcome drawback of jwt what's the solution for it

[@ombhandari6148]

Finally understood it. Thanks to you brother ✨❤

[@piyushgargdev]

Most welcome 😊

[@rahulsbytes]

@07:35 The session will only destroy only when the session data in server memory if you store session data into database then after restating the session data will not destroy

[@LeoWasHere1]

yeah but that will increase database calls and slower the performance of the application

[@sahildhanawade]

session cookie bhi to chori ho sakti hai like jwt token am i right its user's responsibility to keep it safe please correct me if I am wrong

[@thoropyt9955]

Same opinion

[@imvivekkushwaha]

Hi I want to call the API on the server in next.js but token is in localstorage. How I do this. It is causing me to call all API on client side

[@ErLakhan]

Great, Have a question, How do we invalidate JWT in serverless environment..

[@Ganeshthokala97]

We can set expiry for access token and refresh token. But we can't invalidate directly unless we store that JWT in our DB. But if we need to invalidate all we can change the signature and hash key 😅

[@radhikakhatri6851]

Amazing Explanation!!

[@nitinkumarpachori688]

well explanation Piyush 🤝

[@XoXoHarsh]

If JWT token can be taken by hacker and whats stopping hacker to get session id? how is session more secure i couldn't understand.

[@parassetia4964]

Great content and way of explanation

[@farhanali4623]

i think we can store session in DB itself with its life, to avoid re run of server issue

[@lokehirl]

bro, db me query krna is time consuming as well as costly

[@faizshaikh4256]

great explanation sir!!

[@riturajprajapati5660]

If someone copied the jwt token or theft token and after logout trying to access any page of information then how can we handle it

[@AbhishekKumar-wx3rw]

thanks a lot bro was a great video

[@ritikadhangar2979]

Best Explanation😇

[@user-ox1wu7iz1l]

Best on Authentication

[@bhavyasrivastava9656]

Hey hi JWT aren't that secure but then what about security?? Please tell me how to make the JWT token secure???

[@crackit5254]

Gajab bhai 🙌

[@jaydattr9765]

you explained really well

[@maverickansh]

wow ! clearity ++

[@mm333-e1t]

Can u pls make a video explaining how are sessions and jwts are practically implemented and wat is done to handle their flaws.

[@piyushgargdev]

Sure

[@shubhamsharma-js7xf]

Please make video where you can tell how we can manage token. Like this is right user or not If hacker stole out token how we can prevent then not to access my details etc. Thanks in advance ❤❤

[@kirtikedia6274]

Cant hacker steal session id as well in the same way they are stealing Tokens?

[@AsmaKhan-qf6gd]

in case of session authentication session_id is automatically generated when we start session and store in cookies?

[@agentgamer1150]

To jo jwt token copy krha h usko to phir credentials maloom hi honge jo copy krha h

[@KaushalWaghela]

bhai agar without user login api par authentication lagana ho to kese kar sakte?

[@anupamchaudhary1015]

great explaination bro

[@SHIVAMOJHA21]

how can we encrypt jwt?

[@webverse8564]

how do you overcome security issues with JWT token make a video on that

[@vinayjangra1401]

Thanks a lot 😀😀👍👍🙏🙏

[@ayushjindal4981]

Does every user have a separate signing key in case of JWT? if yes, then it would require memory to store it..right? Also, if we are storing the token-id with the user id, there also memory is being used..

[@coderx7177]

The server don't remember the jwt as it was doing in case of session, in case of session it was keeping the track of the uniquely assigned session id to the user details, whereas in case of jwt it don't really keep the track which jwt is assigned to which user instead it just signs it and now it's user's/client's headache to keep it secure, and send it with every request that needs to be authenticated. Since there is no such persisting map in server regarding which user is associated with which jwt, jwt it is called stateless.

[@iamyuvraj128]

Well explained 🔥

[@laxmangiri5511]

bro where we store signature in server. So how can it be serverless since we are storing signature in server?

[@muditkhanna8164]

the server uses an external db for mapping signature with the user. and meanwhile in sessions the session id is not stored in an external and on refreshing ,we get logged out.

[@razahaider6173]

Great explanation.

[@piyushgargdev]

Glad you liked it

[@fightforfitness2256]

Thank you bhaiya.

[@pk21734]

Bhai, ek doubt hai, jo sessions mein user information store ho rahi hai in memory, jwt ke case mein bhi kahin store hoti hai na, even if it's in the API provider, so how is memory a problem in sessions but not in jwt?

[@Harsh-rm1tp]

Jwt m koi data store nai Krna hota. Bas ek secret key hoti hai jo env variables m add hoti hai.

[@pk21734]

@@Harsh-rm1tp okayy

[@disha_on_air]

Great, higly recommend

[@Abhay-d8j]

good video 👍

[@mma-dost]

Please make a practical tutorial authentication with jwt something like this please bhaiya ?

[@piyushgargdev]

Okay sure

[@harshsijariya6005]

good explanation

[@akash_gupta_2090]

great video

[@Onemanfive]

make video on ola api setup in next js

[@ri-deep]

Awesome sir

[@suryanshverma2311]

Sir please serverless ka detailed course launch karo

[@Aditya_Kumar_Alok]

Nice Explain

[@princeyadav8034]

How to store token in browser

[@piyushgargdev]

Local Storage

[@MuzzaferAli]

store in cookies. localStorage and sessionStorage do not provide enough security for storing auth tokens

[@biggestgamelibrary4025]

@@MuzzaferAli what if it's encrypted before being stored in local or session storage ?

[@payalkatoch4377]

nice voice

[@Alim-290]

session bhi to chori ho skta h ?

[@yashvant6482]

Yes, if hacker connected in same network and capture the user's cookies or session and use that same session to login without userid and password 😶😃

[@MuzzaferAli]

Hey, session id is stored in browser cookies and it can also be stolen. Btw token authentication is more secure than session authentication!!

[@piyushgargdev]

Yes, you are correct. In this video I just gave a comparison about the two ways. I hope I didn’t made any wrong statement in video 😅.

[@gaurav-yadav]

Memory = RAM

[@rishiraj2548]

Demigod

[@sakshishrivastav1670]

i love u

[@ajazulhaq3176]

This was beyound infinity 😂