Q. How Do Session ID, Access Token, and JWT Compare, and What Are the Main Security Considerations During Development?

Specific Inquiry

I would like to know how Session ID, Access Token, and JWT, the representative technologies used for user authentication and authorization, differ.
I am also requesting help because I want to know the main points that should be considered to secure each technology.

---

Session ID, Access Token, and JWT (JSON Web Token) are representative technologies used for authentication and authorization of a user (or a system). In practice these technologies are used in combination, but each has distinct characteristics of purpose, storage location, and creation and management. Understanding those characteristics well makes it possible to select a suitable technology appropriately.

Category	Purpose	Creation Method	Storage Location	Management Method
Session ID	A technology that represents the user’s authentication state in traditional session-based authentication and that can identify that user’s state each time the client sends a request to the server	When the user logs in, the server creates session information in a database or in memory by various methods and delivers the unique ID of that session to the client	Stored mainly as a cookie in the client’s browser	The server tracks and manages the user’s state and information through the Session ID
Access Token	A technology used mainly in authorization frameworks such as OAuth or OAuth 2.0, which can identify that the user has been granted permission to access a specific resource	After the user completes the authorization process, the authorization server creates an Access Token and delivers it to the client	It can be stored in various ways, but in a web application it is stored mainly in a cookie or in Web Storage (localStorage, sessionStorage)	It is common to set a validity period for a token for a defined length of time, and when the validity period expires the user must log in again and have the server issue a new token
JWT(JSON Web Token)	A technology used in a distributed environment such as a microservice architecture to send and receive, between the client and the server, a token in JSON form carrying user authentication and authorization, other user information, the token expiration period, and similar information	After processing user authentication, the server creates a JWT, signs it with the server secret key, and delivers it to the client	Delivered and stored in various ways, including a cookie, Web Storage, and an HTTP header	When the client sends a request to the server together with the JWT it received from the server, the server verifies the validity and integrity of that JWT (this depends on the implementation) and then processes the client’s request

1. Apply SSL/TLS to encrypt data in transit
   – Because a Session ID comes to hold various information, apply SSL/TLS encryption on the communication path to prevent MITM and to secure data sent and received.
   – This can be implemented by installing a certificate on the web server and enabling HTTPS, and by configuring every HTTP request to redirect to HTTPS.
2. Set HttpOnly to control cookie access
   – Setting the HttpOnly flag to restrict cookie access through JavaScript can minimize XSS attacks.
   – A cookie can be created with the HttpOnly option included, and when the framework supports HttpOnly it can be implemented simply by enabling this option.
   document.cookie = "sessionid=1234567890; HttpOnly";
3. Set the Secure flag so the cookie is transmitted only over HTTPS
   – Adding the Secure option when the cookie is created strengthens security by transmitting the cookie only over an HTTPS connection.
   – The implementation method is to add the Secure option when creating the cookie, and when the framework supports the Secure option it can be implemented simply by enabling this option.
   document.cookie = "sessionid=1234567890; Secure";
4. Set a timeout for the session validity period
   – If a created session is stolen, an attacker can analyze it and abuse it through a replay attack, pattern guessing, or similar means.
   – When session information is stored in the server database or memory, store the expiration time with it, and check the session expiration time on every request.
5. Implement session regeneration for critical business processing
   – Setting a session validity period can strengthen security, but when critical processing such as a password change or a privilege change occurs, regenerate and reissue the session to prevent the traditional fixed session attack.
   – Most frameworks support a session regeneration mechanism, so use this feature.

1. Set the token validity period
   – Set a validity period for the token, taking token leakage or theft into account.
   – When issuing a token in OAuth 2.0, JWT, or a similar mechanism, set the token validity period by setting an attribute such as ‘expires_in“ or “exp”.
   – Also implement the server so that it rejects a token whose validity period has expired.
2. Restrict accessible resources
   – Even if a token is leaked, minimize the scope of damage by restricting the resources that can be accessed with that token.
   – In OAuth 2.0, the resource access range of a token can be specified through the “scope” parameter when the token is requested.
   – Also implement the server so that it inspects the token scope and restricts the operations that can be performed with that token.
3. Implement token revocation
   – Implement a function that forcibly revokes the relevant token when suspicious activity is detected.
   – Implement a separate API that revokes a token, and reject revoked tokens.
4. Use secure token storage
   – Store a token that the server creates and delivers to the client in secure storage.
   – For a web application, local storage is vulnerable to XSS attacks, so implement storage with session storage or the HttpOnly option.
   – For a mobile application, store the token in a secure storage area such as the iOS Keychain or the Android Keystore.

Security considerations for JWT development are extensive, so they will be covered in a separate write-up.