im not going to explain ALL the difference, there are simply too many, but lets look at some:
Session based login (FormLogin)
You present your username and password to the server. The server then creates a session token. This token is in general just a random string. But before we give this string to the client, we also store the string on the server and we also store a boolean flag next to it telling us that the session is "logged in" or we usually call it authenticated.
The client takes this session token and sends it to us everytime it needs to make a request. Everytime someone then sends this token to us we check in our little storage are that we have a record of that token, and that the flag is set to true so.
So we check:
- we created the session token
- that the token is still logged in
When the client wants to log out, they just send us a logout request, and we just remove that record from our little storage.
Everything works fine so far. Lets introduce another server.
So first server authenticates the user with username and password, and we create a session cookie and return this to the browser, we also store it and everything is the same as before.
But this time we present the cookie (our session token) to server number two.
Server two has no idea what this token is. It has no store to check since it wasnt the one that created the token in the first place. So the server must then call the server that created the token, or the server that created the token must send over the session information to server 2 before.
And with that it becomes hard scale, because then servers need to constantly talk to each other asking things like "what is this token?", "is it valid?" if you have 100s of servers and millions of users, this is a problem.
Token based (oauth2 with JWTs)
In a token based world you have someone that authenticates a user (perhaps using username and password) and that someone issues a token. This service is usually called an issuer.
A JWT is cryptographically signed, which means that if we have a key, we can check that the token hasn't been changed or tampered with.
If we make sure all servers have the key, all servers can independently check that each token they receive is authentic. They dont need to ask the issuer if its authentic, because they can check themselves.
This way the server doesnt need to constantly ask the server that created the token "What is this token?, is it valid?" etc.
And thus we can now scale as long as we can make sure that all servers that need to verify tokens has the proper key to do the validation.
In this scenario no own has a complete record of all the tokens, which means its harder to log someone out. So instead you have to have tokens that are short lived.
Each token contains a timestamap for how long it is valid, and when its not the client needs to refresh this token.
And this is where things usually gets complicated.
So no they are not alike at all. Session based and token based are very different, and i cant explain to you all the differences but here where a few. If you want more information i suggest you read more about it on the internet.
