Session vs Token Authentication: JWT vs Cookies Compared

The web operates on a client-server architecture where clients (browsers) consume services from servers. Communication occurs via HTTP/HTTPS protocols, with URLs structured as protocol://subdomain.domain.extension/path. HTTP requests contain methods (GET, POST, PUT, DELETE, PATCH), URLs, headers, and bodies. Responses include status codes (200 OK, 404 Not Found, 500 Error) and bodies. HTTPS provides encryption through SSL/TLS certificates for secure communication. APIs enable different software systems to communicate regardless of programming language differences, using universal formats like JSON. REST (Representational State Transfer) is the standard implementation approach utilizing HTTP methods for stateless communication.

The web operates on a client-server architecture where clients (such as web browsers like Firefox, Chrome, or Safari) send requests to servers (computers or applications that process these requests and generate responses) using the HTTP protocol, which establishes the communication rules between them; URLs (Uniform Resource Locators) serve as unique addresses that identify specific resources on the web, consisting of components like the protocol (http/https), domain name, and path that guide the server to deliver the requested content.

Client-server architecture is a fundamental web development model where clients (like browsers) send requests to servers (powerful machines that process data and store information), with HTTP (HyperText Transfer Protocol) enabling data transmission and HTTPS adding encryption for secure communication. This architecture can be implemented in two-level (client-server), three-level (client-server-database), or multi-level configurations, with thick clients performing most processing locally while thin clients rely on servers for computation.

Candidates should understand HTTP and HTTPS protocols, including common HTTP methods (GET, POST, PUT, DELETE) and what constitutes a web request. Understanding client-server architecture is essential, including how browsers communicate with servers to retrieve and display web content.

API (Application Programming Interface) is a connection between two technologies that enables communication and data exchange. In web development, APIs serve as bridges between different systems. The client-server architecture involves a client (web browser) sending requests to a server (backend), which responds with data. This communication typically occurs over the HTTP protocol. Understanding these fundamentals is essential before diving into practical API interactions.

This video explains the three main browser storage mechanisms: localStorage (persistent storage with 10MB capacity that survives browser restarts), sessionStorage (temporary storage with 10MB capacity that clears when the tab/window closes), and cookies (smaller 4KB capacity that can be transmitted with HTTP requests and have configurable expiration times). The instructor demonstrates practical usage through code examples, showing how to set, get, and remove data from each storage type, and emphasizes that all three are browser-based caches that work differently in terms of persistence, scope, and data transmission capabilities.

Browser storage mechanisms include Local Storage (persistent data that survives browser sessions, suitable for user preferences and shopping carts but lacks security), Session Storage (temporary data that clears when the browser closes, isolated per tab for security), and Cookies (server-communicating data with 4KB limit, used for tracking and session management). Local Storage persists across sessions, Session Storage clears on browser close, and Cookies can be read/modified by servers.

Browsers provide multiple storage mechanisms for client-side data management. Cookies are small key-value pairs sent with every HTTP request to the same domain, enabling session tracking and user identification. LocalStorage persists data indefinitely across browser sessions, while SessionStorage clears data when the session ends. Each mechanism serves different use cases: cookies handle authentication and session state, localStorage manages larger datasets requiring persistence, and sessionStorage handles temporary session-specific data.

The three primary browser storage mechanisms serve different purposes with distinct characteristics. Cookies have a storage limit of approximately 4 kilobytes and are transmitted with every HTTP request, making them ideal for authentication tokens and server-client shared state synchronization. Local storage offers much higher storage capacity and persists indefinitely across browser sessions, perfect for storing application state like user preferences (dark/light mode settings). Session storage also provides substantial storage but clears automatically when the browser tab or window closes, making it suitable for temporary data retention such as form input during checkout processes where users shouldn't lose progress upon refreshing the page.

Browser storage mechanisms (cookies, local storage, and session storage) address HTTP's stateless nature by tracking user information. Cookies store session data with ~4KB capacity, can be read/written by both clients and servers, and expire based on settings. Local storage provides 5-10MB capacity, persists across browser sessions, and requires manual JavaScript clearing. Session storage offers 5MB capacity, works per window/tab, and automatically clears when the session ends. Cookies enable server communication while local/session storage are client-only. Best practices: use cookies for server-side data requiring TTL, session storage for specific tab-based use cases, and local storage for application-wide global data.

Cryptography is the science of securing data through techniques that scramble information into unreadable ciphertext, accessible only to authorized parties with the correct key. The video covers three main encryption forms: symmetric encryption (using one key for both encryption and decryption, the oldest method), asymmetric encryption (using public/private key pairs where one encrypts and the other decrypts), and hashing (converting data into fixed-length values for verification). Cryptographic hash functions must be deterministic, computationally fast, preimage resistant, collision resistant, and puzzle-friendly. Digital signatures provide verification, non-forgeability, and non-repudiation by encrypting message digests with private keys. HTTPS secures web communication through a seven-step process involving key exchange and symmetric encryption.

Hashing provides integrity but not confidentiality; encryption provides confidentiality but not integrity. Digital signatures combine both for non-repudiation. Modern encryption uses hybrid approaches: asymmetric encryption exchanges symmetric session keys securely, then symmetric encryption handles bulk data efficiently. Asymmetric encryption solves key distribution problems with strangers. Understanding this distinction between hashing and encryption is critical for exam success.

Cryptographic hashing converts data into a fixed-size string (hash) that provides data integrity, authentication, and non-repudiation; good hashing algorithms like SHA-256 produce vastly different outputs for even minor input changes and avoid collisions, while digital signatures use private/public key pairs to verify message authenticity and origin by hashing the message and encrypting the hash with the sender's private key, which recipients can verify using the sender's public key.

Cryptography is the art of hiding information, consisting of three main areas: hashing (one-way transformation using algorithms like SHA-256 to verify file integrity and secure passwords), symmetric encryption (using the same key for encryption and decryption, with AES being the standard), and asymmetric encryption (using a public key for encryption and a private key for decryption). This tutorial demonstrates how to implement these concepts in Python using libraries like cryptography, zxcvbn, and bcrypt to build a practical command-line cryptography tool.

Hashing is a cryptographic algorithm that takes arbitrary input data and produces a fixed-size output called a hash value, used primarily to verify data integrity by detecting any unauthorized modifications; digital signatures enhance this by encrypting the hash with the sender's private key, providing three security benefits: authentication (verifying the sender's identity), non-repudiation (preventing the sender from denying their actions), and integrity (ensuring data hasn't been altered), with common algorithms including MD5 and SHA for hashing, and asymmetric cryptography for digital signatures.