Which should I pick for a standard web app?

Server-side sessions, via your framework's built-in middleware. You get instant revocation, per-device session lists, and battle-tested CSRF protection for free, and a Redis session store scales further than most products ever need. Reach for tokens when the topology demands them: mobile clients, many services verifying independently, or cross-domain APIs.

If I put a JWT in an httpOnly cookie, is that session or token auth?

It's token authentication using a cookie as the transport. The server still verifies a signature statelessly rather than looking up a session record. But because the browser now attaches the credential automatically, you inherit cookie problems too, so you need SameSite and CSRF defenses on top of the token's own expiry handling.

Is localStorage ever acceptable for tokens?

For a credential whose theft you care about, no; any XSS or compromised third-party script reads localStorage and ships the token out. If you must keep tokens in JavaScript-land, hold the short-lived access token in memory only and keep the refresh token in an httpOnly cookie. The standard recommendation remains httpOnly cookies for anything long-lived.

Securitychapter 4 of 4 · 4 lessons

Session vs Token Authentication

Stateful sessions stored server-side vs stateless tokens carried by the client.

← All chapters View in cheatsheet

Somebody's laptop is stolen. They call support, and support clicks log out everywhere.

In one design, that deletes a row and the thief is locked out on their very next click. In the other, the thief keeps full access for up to an hour and there is nothing anybody can do about it.

The difference is where the answer to who is this lives. On your server, referenced by an ID in a cookie, or inside the credential itself, signed and readable without asking anyone.

Everything else, the scaling, the mobile story, the cross-domain awkwardness, follows from that one choice, and so does how fast you can revoke.

Lessons

4 in this chapter

Server-Side SessionsA random ID in a cookie pointing at server state: one lookup per request buys total control.3 min
Stateless TokensMove the truth into a signed token and the per-request lookup, and its dependencies, disappear.2 min
The Hybrid RealityProduction systems converge on short stateless access tokens plus a small, revocable stateful core.2 min
CSRF and Storage PitfallsCookies get attached automatically and localStorage is readable by script: pick your poison carefully.3 min