Node.js (v18+)
\nPostgreSQL (v14+)
\nRedis (v7+)
\nPostman (for testing)
\nDocker
\nCopy the access_token and save it as a Postman variable
Stateless authentication: the token itself carries all necessary user information. The server verifies the token's signature without maintaining a session.
\nFlow:
\n1. User logs in with credentials
\n2. Server generates a JWT with user payload
\n3. Client stores token (e.g., localStorage)
\n4. Client sends token in the Authorization header on each request
5. Server verifies the token’s signature
\nPros
\nScalable (no server session state)
\nWorks across domains
\nCons
\nCannot easily invalidate tokens
\nToken size can be large
\nCompromised tokens can allow unauthorized
\nPostman will automatically handle cookies. The session cookie will be stored
\n","urlObject":{"protocol":"http","port":"3000","path":["auth","session","login"],"host":["localhost"],"query":[],"variable":[]}},"response":[{"id":"814df90c-4ff5-4329-b18e-5d3ab49320a3","name":"login","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"email\": \"2user@example.com\",\r\n \"password\": \"password123\"\r\n}","options":{"raw":{"language":"json"}}},"url":"http://localhost:3000/auth/session/login"},"status":"Created","code":201,"_postman_previewlanguage":"Text","header":[{"key":"X-Powered-By","value":"Express"},{"key":"Vary","value":"Origin"},{"key":"Access-Control-Allow-Credentials","value":"true"},{"key":"Content-Type","value":"application/json; charset=utf-8"},{"key":"Content-Length","value":"219"},{"key":"ETag","value":"W/\"db-RNsqVnTGlEjjjt12sZn31VNB4T4\""},{"key":"Set-Cookie","value":"connect.sid=s%3AyFU4LZMua1RbuEvmVfpUjVq9r92kEmbu.N2%2FNSVyHVfjvjoO%2FOx8tWJUMlbJCarMOvepBk8bcIAI; Path=/; Expires=Thu, 29 Jan 2026 23:22:29 GMT; HttpOnly; SameSite=Lax"},{"key":"Date","value":"Wed, 28 Jan 2026 23:22:29 GMT"},{"key":"Connection","value":"keep-alive"},{"key":"Keep-Alive","value":"timeout=5"}],"cookie":[],"responseTime":null,"body":"{\n \"message\": \"Session login successful\",\n \"user\": {\n \"id\": \"8ef0efdb-f2ca-460d-bb4d-b19efe514ecc\",\n \"email\": \"2user@example.com\",\n \"name\": \"Session User\",\n \"createdAt\": \"2026-01-28T22:21:15.516Z\",\n \"updatedAt\": \"2026-01-28T22:21:15.516Z\"\n }\n}"}],"_postman_id":"0c6794fc-7f1b-494b-aa65-853b0eec09bd"},{"name":"profile","id":"426f7f8d-33b7-4301-8134-a6bc2ff56a23","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"http://localhost:3000/auth/session/profile","description":"Note: No Authorization header needed! Cookie is sent automatically.
\n","urlObject":{"protocol":"http","port":"3000","path":["auth","session","profile"],"host":["localhost"],"query":[],"variable":[]}},"response":[{"id":"25776959-fa9d-4872-b71e-68254bc0c46d","name":"profile","originalRequest":{"method":"GET","header":[],"url":"http://localhost:3000/auth/session/profile"},"status":"OK","code":200,"_postman_previewlanguage":"Text","header":[{"key":"X-Powered-By","value":"Express"},{"key":"Vary","value":"Origin"},{"key":"Access-Control-Allow-Credentials","value":"true"},{"key":"Content-Type","value":"application/json; charset=utf-8"},{"key":"Content-Length","value":"149"},{"key":"ETag","value":"W/\"95-Cz36Eg4MQJuugaIKuu95dyjPAyI\""},{"key":"Date","value":"Wed, 28 Jan 2026 23:33:44 GMT"},{"key":"Connection","value":"keep-alive"},{"key":"Keep-Alive","value":"timeout=5"}],"cookie":[],"responseTime":null,"body":"{\n \"message\": \"Session authentication successful\",\n \"user\": {\n \"id\": \"8ef0efdb-f2ca-460d-bb4d-b19efe514ecc\",\n \"email\": \"2user@example.com\"\n },\n \"strategy\": \"session\"\n}"}],"_postman_id":"426f7f8d-33b7-4301-8134-a6bc2ff56a23"},{"name":"logout","id":"f9b92973-b2ca-4580-af69-437eef6afd85","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"http://localhost:3000/auth/session/logout","urlObject":{"protocol":"http","port":"3000","path":["auth","session","logout"],"host":["localhost"],"query":[],"variable":[]}},"response":[{"id":"78a214c6-2cab-45d9-ae84-f045773e99bc","name":"logout","originalRequest":{"method":"POST","header":[],"url":"http://localhost:3000/auth/session/logout"},"status":"Created","code":201,"_postman_previewlanguage":"Text","header":[{"key":"X-Powered-By","value":"Express"},{"key":"Vary","value":"Origin"},{"key":"Access-Control-Allow-Credentials","value":"true"},{"key":"Content-Type","value":"application/json; charset=utf-8"},{"key":"Content-Length","value":"39"},{"key":"ETag","value":"W/\"27-oDQKK7RL1khiBoVX82BPWT4RdLg\""},{"key":"Date","value":"Wed, 28 Jan 2026 23:34:35 GMT"},{"key":"Connection","value":"keep-alive"},{"key":"Keep-Alive","value":"timeout=5"}],"cookie":[],"responseTime":null,"body":"{\n \"message\": \"Session logout successful\"\n}"}],"_postman_id":"f9b92973-b2ca-4580-af69-437eef6afd85"}],"id":"e7deceb4-c941-433b-966c-76a1e1dabd02","description":"A session ID is stored in a secure HTTP-only cookie, while session data is kept on the server (Redis). Each request validates the session via Redis.
\nFlow:
\nUser logs in
\nServer creates a session in Redis
\nSession ID sent to client (HTTP-only cookie)
\nClient sends cookie automatically
\nServer validates session with Redis on each request
\nPros
\nImmediate session invalidation
\nServer-controlled security (e.g., secure cookies)
\nCons
\nCan require sticky sessions for scalability
\nNeeds session storage
\nKey Difference: This token contains a jti (JWT ID) that's validated against Redis whitelist.
Token is removed from Redis whitelist. Future requests with this token will fail.\nTest: Try calling /auth/hybrid/profile again with the same token - it should fail with 401!
\n","urlObject":{"protocol":"http","port":"3000","path":["auth","hybrid","logout"],"host":["localhost"],"query":[],"variable":[]}},"response":[{"id":"3f598f42-0355-4509-8e07-fd3864fae170","name":"logout","originalRequest":{"method":"POST","header":[],"url":"http://localhost:3000/auth/hybrid/logout"},"status":"Created","code":201,"_postman_previewlanguage":"Text","header":[{"key":"X-Powered-By","value":"Express"},{"key":"Vary","value":"Origin"},{"key":"Access-Control-Allow-Credentials","value":"true"},{"key":"Content-Type","value":"application/json; charset=utf-8"},{"key":"Content-Length","value":"62"},{"key":"ETag","value":"W/\"3e-gFljDx3NbkG553SkOF/eIiaMWrw\""},{"key":"Date","value":"Wed, 28 Jan 2026 23:39:51 GMT"},{"key":"Connection","value":"keep-alive"},{"key":"Keep-Alive","value":"timeout=5"}],"cookie":[],"responseTime":null,"body":"{\n \"message\": \"Logout successful. Token removed from whitelist.\"\n}"},{"id":"02843044-92c7-4a8b-ba1d-fa24fe2b76e5","name":"second-attempt","originalRequest":{"method":"POST","header":[],"url":"http://localhost:3000/auth/hybrid/logout"},"status":"Unauthorized","code":401,"_postman_previewlanguage":null,"header":[{"key":"X-Powered-By","value":"Express"},{"key":"Vary","value":"Origin"},{"key":"Access-Control-Allow-Credentials","value":"true"},{"key":"Content-Type","value":"application/json; charset=utf-8"},{"key":"Content-Length","value":"78"},{"key":"ETag","value":"W/\"4e-mbURCyRBYgPRSz4+jQin0wAx230\""},{"key":"Date","value":"Sun, 01 Feb 2026 14:36:02 GMT"},{"key":"Connection","value":"keep-alive"},{"key":"Keep-Alive","value":"timeout=5"}],"cookie":[],"responseTime":null,"body":"{\n \"message\": \"Token is not whitelisted\",\n \"error\": \"Unauthorized\",\n \"statusCode\": 401\n}"}],"_postman_id":"b91068db-9f02-4875-acb7-27cbfcad3498"}],"id":"934e3ef4-ef6c-4561-af77-26ee278e83b0","description":"Leverages JWT for stateless authentication but stores token IDs in Redis whitelist for revocation.
\nFlow:
\nUser logs in, receives JWT
\nToken ID stored in Redis whitelist
\nEach request: server checks JWT validity and Redis whitelist
\nLogout removes token from whitelist
\nPros
\nScalable as JWT
\nImmediate revocation
\nCons
\nRedis lookup on each request
\nMore complex setup
\nSave both tokens:
\naccess_token - expires in 15 minutesrefresh_token - expires in 7 days
Old refresh token is invalidated
New refresh token is issued (token rotation)
If old refresh token is used again, it fails (detects theft)
The strategy: short-lived access tokens for requests, long-lived refresh tokens for renewal.
\nFlow:
\nLogin issues access (e.g., 15m) & refresh tokens (e.g., 7d)
\nAPI requests use access token
\nExpired access token can be renewed with refresh token
\nServer issues new access (& optionally refresh) tokens on renewal
\nToken Rotation:
\nOn refresh, the server issues a new refresh token and invalidates the old
\nAttempts to reuse an old refresh token can be detected (token theft)
\nPros
\nMinimal damage if access token compromised
\nRefresh tokens can be revoked for security
\nCons
\nMore complex implementation
\nSecure storage for refresh tokens required
\n