Which one do you prefer when it comes authentication? (session or jwt)

[scenic harness]

I've like to know if it's okay to use only session on authentication? or much better to use jwt like having access token and refresh token?

[golden lark]

Sessions are fine for most web applications. Jwts add complexity that you most likely don't need. But you can go from one to the other if needed, so you won't be locking yourself down to one path should you change your mind.

[pearl wing]

Jwt, if you have sso server like keycloak.

[scenic harness]

Does session security provide enough protection against attackers or hackers?

[pearl wing]

If you use nestjs as microservice server, you shall not implement as session. Session only suitable for frontend connected server

[scenic harness]

if I'm making a microservice what authentication approach should I use?

can I use jwt as a session?

like the jwt encoded