Authentication Strategies: JWT vs Session vs OAuth2 vs SAML
Fast recall
Quick revision
Core answer
Understanding of different auth patterns, trade-offs, and when to pick each
'JWT is stateless so always better'; putting sensitive data in JWT; not knowing revocation challenges
Discuss short-lived access tokens + refresh, PKCE, token introspection, SAML vs OIDC in enterprise
Interview-ready guide
Interview answer
The four are different things
- Session/JWT: token formats for authenticated requests
- OAuth2/OIDC/SAML: protocols for how to obtain tokens and delegate identity
- An OAuth2 flow can produce a JWT access token
- A session-based app can be authenticated via SAML SSO
Decision framework
Session
- First-party web app; server-rendered
- Need instant revocation
- Single domain
- Redis-backed for scale
JWT raw
- Service-to-service in your services
- Mobile/SPA to your API
- Stateless scaling
- Accept delayed revocation or implement
jtiblocklist
OAuth2/OIDC
- 'Login with Google/Microsoft/GitHub'
- Enterprise SSO with modern IdP
- Federated identity
- Microservice central auth
- Mobile with PKCE
SAML
- Enterprise B2B mandate
- Legacy systems
- ADFS, Azure AD SAML
- IdP-initiated flows
Best practices condensed
- Session: HttpOnly + Secure + SameSite + rotate on login
- JWT: short expiry + asymmetric signing + validate iss/aud/exp + don't
localStorage - OAuth2: Authorization Code + PKCE + state + validate ID token nonce
- SAML: sign assertions + validate cert + InResponseTo check + cert rotation plan
2026 rule of thumb
- First-party web -> session + cookies
- APIs / microservices -> OIDC JWT short-lived + refresh
- Enterprise SSO -> SAML or OIDC by customer
- Mobile -> OIDC + PKCE
Avoid
- Inventing your own token format
- Entire user object in JWT
- Long-lived JWT without revocation plan
- localStorage tokens
- Session without SameSite
Mental model
- Identity: who? (session, OIDC ID token, SAML assertion)
- Authorization: what can they do? (scopes, roles)
- Session format: cookie session ID, JWT, or opaque
- Pick each layer intentionally
Authentication Strategies: JWT vs Session vs OAuth2 vs SAML
Direct Answer
Session auth stores a random session ID in a cookie; server keeps state (Redis or sticky). Simple, instantly revocable, secure by default. JWT stores signed claims in a token carried in headers; stateless, scales horizontally, but revocation is hard. OAuth2 is a delegation framework — you redirect to an authorization server (Google, Okta, Auth0, Cognito) which authenticates and returns tokens. OIDC sits on OAuth2 for identity. SAML is XML-based enterprise SSO — common in B2B/workforce, heavier than OIDC. 2026 rule: first-party web -> session + cookies; APIs/microservices -> OIDC JWT (short-lived + refresh); enterprise SSO -> SAML or OIDC by IdP; mobile -> OIDC + PKCE.
Common Mistakes & Pitfalls
'JWT is stateless so always better'; putting sensitive data in JWT; not knowing revocation challenges
Check your understanding
Answer these without looking back at the article.
- How does refresh token rotation detect reuse and prevent replay attacks?
- Why is PKCE required for public OAuth2 clients?
- How do you revoke a JWT before it expires?
- Compare OIDC Authorization Code flow with and without PKCE
Related interview prep categories
2Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.