JWT.
also: JWTs · JSON Web Token · JSON Web Tokens · client-side sessionsA signed token carrying session claims (user, roles, expiry) that servers verify without a session lookup.
the two-minute refresher
- The server signs {user_id, roles, exp}; the client sends it back on every request.
- Verification is a signature check: no storage and no network call.
- Weaknesses: you can't invalidate a session before it expires, and key rotation is complex.
- Size is capped by the cookie (about 4 KB) and the whole session travels on every request.