SECURITY AND SCALABILITY TRADE-OFFS IN WEB AUTHENTICATION: A COMPARATIVE BENCHMARKING OF JWT AND SESSION-BASED MECHANISMS

In modern web development, choosing the right way to log in and identify users (authentication) is one of the most important decisions for software developers. This paper compares two popular authentication methods: traditional Session-based authentication (which uses cookies and stores user data on the server) and modern JSON Web Token (JWT) authentication (which stores user data inside a secure token on the client side). The paper analyzes both methods in terms of server memory usage, speed, system scaling, and resistance to common security threats like Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). The goal of this research is to give web developers clear and practical guidelines on when to use each authentication approach.