Token vs Session Authentication | Authentication Explained!!!

[@himankshu]

I love your teaching style. One thing if you add to make it cherry on the top is show real life examples

[@the-white-fang]

Interesting video. I do have a couple of questions though. The arguement of being token stolen seems like an unfair one since that could happen to cookies as well. Though there are some scenarios where sessions aren't just a valid answer for example mobile apps. Usually in mobile apps you can't really rely on sessions being persisted and can't expect the users to login in over and over again. On the other hand session based authentication works really well for the web apps. Ofcourse if you work in development professionally, you will need to implement both a lot of times with consistent behaviour. This is a good introduction for beginners though but it would be great if it was mentioned that there were more advanced forms of authentication methods and links to the documentation would have been a massive plus.

[@vishalpable9636]

Great explanation Piyush, I am thrilled to see this video because you explained it more clearly and easily understandable 👏

[@suchanachakrabarti6783]

The Easiest explanation of all times!

[@ersouravkmr]

Lovely Lecture ❤❤ , Cleared All my doubts about Authetication Process , Token Vs Session Based , Stateless vs State fulll. Saw your another lecture on SSO. Cleared all doubts on that Topic also .

[@parikshitjagtap7633]

Awesome explanation.. One of the best video I ever seen for token and sessions..

[@ashishsng]

I am saying this very honestly.. what a explanation!🔥🔥

[@yatendraupadhyay2180]

Bhai you deserve many more subscribers. Such a simple yet comprehensive explanation.

[@roshanshah7364]

I think for improving security we can save the jwt token in cookies instead of local storage.

[@KirtanPatel552]

Mind Blowing Video Piyush sir....

[@devlo57]

But token can only be generated when credentials are correct and it can only be leaked from user itself 🤔

[@utsavkumar4826]

serverless can be durable as well, such as azure durable functions

[@haristallat2201]

Perfectly explained, love from Pakistan

[@2brothers346]

Keep continuing this hard work bro🔥🔥

[@piyushgargdev]

Thanks a lot 🎉

[@harshshah2675]

Piyush sir thanks for this detailed explanation. It would be great if you could explain how to overcome drawback of jwt what's the solution for it

[@dharamved]

very helpful video and love your way of making any question easy to understand.

[@raushankumargupta7018]

Perfect explaination Piyush❤

[@radhikakhatri6851]

Amazing Explanation!!

[@user-ox1wu7iz1l]

Best on Authentication

[@faizshaikh4256]

great explanation sir!!

[@parassetia4964]

Great content and way of explanation

[@ombhandari6148]

Finally understood it. Thanks to you brother ✨❤

[@piyushgargdev]

Most welcome 😊

[@AbhishekKumar-wx3rw]

thanks a lot bro was a great video

[@maverickansh]

wow ! clearity ++

[@nitinkumarpachori688]

well explanation Piyush 🤝

[@muditkhanna8164]

Very Effective explanation. but does server stores the secret key string in its database and the respective hash function, that means its still using memory for decoding the specific user from the token? i don't understand how can it be a advantage.

[@AniketSingh-nx4ds]

Its usually stored in config or environment variable, not database

[@anupamchaudhary1015]

great explaination bro

[@ritikadhangar2979]

Best Explanation😇

[@jaydattr9765]

you explained really well

[@fightforfitness2256]

Thank you bhaiya.

[@ErLakhan]

Great, Have a question, How do we invalidate JWT in serverless environment..

[@Ganeshthokala97]

We can set expiry for access token and refresh token. But we can't invalidate directly unless we store that JWT in our DB. But if we need to invalidate all we can change the signature and hash key 😅

[@crackit5254]

Gajab bhai 🙌

[@farhanali4623]

i think we can store session in DB itself with its life, to avoid re run of server issue

[@lokehirl]

bro, db me query krna is time consuming as well as costly

[@vinayjangra1401]

Thanks a lot 😀😀👍👍🙏🙏

[@rahulsbytes]

@07:35 The session will only destroy only when the session data in server memory if you store session data into database then after restating the session data will not destroy

[@LeoWasHere1]

yeah but that will increase database calls and slower the performance of the application

[@disha_on_air]

Great, higly recommend

[@akash_gupta_2090]

great video

[@harshsijariya6005]

good explanation

[@mm333-e1t]

Can u pls make a video explaining how are sessions and jwts are practically implemented and wat is done to handle their flaws.

[@piyushgargdev]

Sure

[@iamyuvraj128]

Well explained 🔥

[@Aditya_Kumar_Alok]

Nice Explain

[@XoXoHarsh]

If JWT token can be taken by hacker and whats stopping hacker to get session id? how is session more secure i couldn't understand.

[@Abhay-d8j]

good video 👍

[@webverse8564]

how do you overcome security issues with JWT token make a video on that

[@sahildhanawade]

session cookie bhi to chori ho sakti hai like jwt token am i right its user's responsibility to keep it safe please correct me if I am wrong

[@thoropyt9955]

Same opinion

[@razahaider6173]

Great explanation.

[@piyushgargdev]

Glad you liked it

[@ri-deep]

Awesome sir

[@imvivekkushwaha]

Hi I want to call the API on the server in next.js but token is in localstorage. How I do this. It is causing me to call all API on client side

[@agentgamer1150]

To jo jwt token copy krha h usko to phir credentials maloom hi honge jo copy krha h

[@bhavyasrivastava9656]

Hey hi JWT aren't that secure but then what about security?? Please tell me how to make the JWT token secure???

[@Onemanfive]

make video on ola api setup in next js

[@riturajprajapati5660]

If someone copied the jwt token or theft token and after logout trying to access any page of information then how can we handle it

[@mma-dost]

Please make a practical tutorial authentication with jwt something like this please bhaiya ?

[@piyushgargdev]

Okay sure

[@SHIVAMOJHA21]

how can we encrypt jwt?

[@suryanshverma2311]

Sir please serverless ka detailed course launch karo

[@KaushalWaghela]

bhai agar without user login api par authentication lagana ho to kese kar sakte?

[@payalkatoch4377]

nice voice

[@ayushjindal4981]

Does every user have a separate signing key in case of JWT? if yes, then it would require memory to store it..right? Also, if we are storing the token-id with the user id, there also memory is being used..

[@coderx7177]

The server don't remember the jwt as it was doing in case of session, in case of session it was keeping the track of the uniquely assigned session id to the user details, whereas in case of jwt it don't really keep the track which jwt is assigned to which user instead it just signs it and now it's user's/client's headache to keep it secure, and send it with every request that needs to be authenticated. Since there is no such persisting map in server regarding which user is associated with which jwt, jwt it is called stateless.

[@AsmaKhan-qf6gd]

in case of session authentication session_id is automatically generated when we start session and store in cookies?

[@pk21734]

Bhai, ek doubt hai, jo sessions mein user information store ho rahi hai in memory, jwt ke case mein bhi kahin store hoti hai na, even if it's in the API provider, so how is memory a problem in sessions but not in jwt?

[@Harsh-rm1tp]

Jwt m koi data store nai Krna hota. Bas ek secret key hoti hai jo env variables m add hoti hai.

[@pk21734]

@@Harsh-rm1tp okayy

[@laxmangiri5511]

bro where we store signature in server. So how can it be serverless since we are storing signature in server?

[@muditkhanna8164]

the server uses an external db for mapping signature with the user. and meanwhile in sessions the session id is not stored in an external and on refreshing ,we get logged out.

[@MuzzaferAli]

Hey, session id is stored in browser cookies and it can also be stolen. Btw token authentication is more secure than session authentication!!

[@piyushgargdev]

Yes, you are correct. In this video I just gave a comparison about the two ways. I hope I didn’t made any wrong statement in video 😅.

[@princeyadav8034]

How to store token in browser

[@piyushgargdev]

Local Storage

[@MuzzaferAli]

store in cookies. localStorage and sessionStorage do not provide enough security for storing auth tokens

[@biggestgamelibrary4025]

@@MuzzaferAli what if it's encrypted before being stored in local or session storage ?

[@Alim-290]

session bhi to chori ho skta h ?

[@yashvant6482]

Yes, if hacker connected in same network and capture the user's cookies or session and use that same session to login without userid and password 😶😃

[@gaurav-yadav]

Memory = RAM

[@sakshishrivastav1670]

i love u

[@ajazulhaq3176]

This was beyound infinity 😂

[@rishiraj2548]

Demigod