How would you implement login for a web app? Compare server sessions with JWT access tokens and explain what you would choose.

What the interviewer wants to hear

• Sessions store state on the server and a random id in a cookie
• JWTs are signed, stateless and hard to revoke before expiry
• Use HttpOnly, Secure, SameSite cookies either way for browsers
• Short-lived access tokens with refresh token rotation if using JWT
• Password hashing, rate limiting and CSRF protection

Model answer

For a normal web app where the browser talks to my own backend, I would use server sessions. On login I verify the password against an Argon2 or bcrypt hash, create a session row in the database or Redis, and set a random session id in an HttpOnly, Secure, SameSite=Lax cookie. Logout or a ban simply deletes the session, so revocation is instant. JWTs are signed tokens the server can verify without a lookup, which helps when many services or mobile clients need to verify identity. The downside is that they are hard to revoke before expiry, so I would keep access tokens short, around 5 to 15 minutes, and use rotating refresh tokens with reuse detection. In both cases I add rate limiting on login, CSRF protection for cookie auth, and I would seriously consider a proven library or provider instead of writing everything myself.

More medium Full Stack Developer questions

• Users say the orders page is slow. How do you find and fix the problem across frontend, API and database?
• How would you build a feature that lets users upload profile photos and PDF documents up to 100 MB?
• Your API is used by a web app and an older mobile app that users do not update quickly. How do you make a breaking change safely?
• Describe a good CI/CD pipeline for a full stack app. What runs on each pull request and how do you deploy safely?
• You need to build a product search page with text search, filters and sorting. Walk through the design from the UI to the database.
• How would you add role-based access control (admin, editor, viewer) to an existing full-stack app?
• What is your testing strategy for a full-stack feature such as "invite a teammate by email"?
• Describe the different layers where you can cache in a typical full-stack web app, and how you keep cached data correct.
• You need to show in-app notifications in real time. How do you choose between polling, server-sent events and WebSockets, and how would you build it?