You Clicked "Log Out." Your Token Still Works for 59 Minutes.

You click "Log out"… and the token you were using still works for the next hour. That's not a bug — it's a design choice: sessions vs JWT. In this video: • How server-side sessions work (and why logout is instant) • How JWTs work: header, payload, signature (and why the payload isn't secret) • Why JWTs can't be revoked, and how refresh tokens quietly bring sessions back — a session wearing a disguise • Why "JWTs scale better" is mostly a myth • localStorage vs HttpOnly cookies: where the token should actually live • Two JWT mistakes that show up in real incidents • A clear rule: when to use sessions, when to use JWTs, and when to use both Related videos • How Password Hashing Works • OAuth 2.0 & OIDC Explained • PKCE Explained • CORS Explained • How Redis Works Sources • OWASP Session Management Cheat Sheet • OWASP JSON Web Token Cheat Sheet • RFC 7519 — JSON Web Token (JWT) • RFC 9700 — Best Current Practice for OAuth 2.0 Security (Jan 2025) Note: Redis lookup times and JWT sizes are typical/illustrative figures, not guarantees — they depend on your setup, claims and signing algorithm. #SystemDesign #WebSecurity #JWT #BackendEngineering Chapters: 0:00 Intro 0:03 You logged out… or did you? 0:48 The problem: HTTP has no memory 1:54 How sessions work 3:15 How JWTs work 4:33 The logout problem 6:29 The "JWTs scale better" myth 7:54 Where to store the token 9:38 Two JWT mistakes 10:21 The decision rule 11:39 Recap