Why did you choose Redis sessions instead of JWT access tokens?

Say it in 30 seconds

Say it like this (20-30 seconds)

MiniTickets uses a random session identifier in an HttpOnly cookie and stores its hash in Redis. That makes logout and device revocation straightforward, and the API keeps no session state in one process. A self-contained JWT could remove the lookup, but immediate revocation would need another mechanism or a short expiry. Our trade-off is a Redis dependency on authenticated requests, which I would make explicit in the availability target.

The deeper answer

The session record contains the user identity and creation time, not a trusted copy of the user’s role. The raw identifier has 32 random bytes; only its SHA-256 hash forms the Redis session key. Both the cookie lifetime and stored session lifetime are seven days.

A per-user sorted set records active session hashes. Reads require membership as well as the session record. Losing the index therefore invalidates sessions instead of reviving a token that was meant to be revoked. A login rotates the identifier and deletes the previous record.

JWT is a format, not a complete session policy. For another system, I would ask about issuer boundaries, acceptable revocation delay, browser storage and key rotation before choosing. Short-lived tokens with refresh sessions are another valid design, with more moving parts.

Counter-questions

Does HttpOnly prevent all XSS harm?

It prevents script from reading the cookie. An injected script may still make authenticated requests, so CSP, safe rendering and server authorization remain necessary.

What happens during a Redis outage?

A session lookup error propagates; it is not treated as a logged-out user or silently accepted. Lost records are different: a missing session yields no authenticated session and requires login.

Can more API tasks share these sessions?

Yes. They consult the same Redis records, so no sticky load-balancer session is required. Redis availability and capacity become shared concerns.

Where in MiniTickets

Read Auth sessions, then inspect the sessions piece →.

apps/api/src/queries/sessions.ts → get