我读过几篇文章，他们说不要使用 JWT，因为它们不安全。而使用 session 有一个缺点，如果服务器重新启动，会话将被注销。
所以我想知道最好的选择是什么？ JWT 或服务器端会话，也请分享任何参考链接，以便我理解和实施。
我正在使用 MongoDB 进行用户注册。那么我应该选择JWT还是Server Side Session呢？
【问题讨论】：
标签： reactjs mongodb authentication react-router jwt
您的问题没有正确和独特的解决方案。
您应该分析您的用例并做出正确的选择。为此，您可以考虑两种解决方案的优缺点。
| Type | Pros | Cons |
|---|---|---|
| JWT | 1) Allow to scale your back-end with stateless authentication 2) You can use the same authentication provider for different applications |
1) The JWT size could be larger than a session ID. It could affect network performance since it is included with each HTTP request. 2) The data stored in the JWT is readable by the client. This may be an issue. 3) In order to revoke a JWT before it expires you need to use a revocation list. This gets you back to the server side storage issues you were trying to avoid. |
| Server Side | 1) Easy to code both the client and server. 2) Easy to destroy a session when someone logs out. |
1) Scalability, because the sessions are stored in the server’s memory, scaling becomes an issue when there is a huge number of users using the system at once. 2) Every HTTP request requires a lookup to the data store |
【讨论】：