I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about:
I learned JWT, built a token, and sent it back and forth between server and client in my local server. Seems like a good thing to do, since using HTTPS, only two parties will be able to communicate in between, therefore quite secure.
However, when I looked into the websites like Facebook, Twitter, Instagram, they don't have token, but have session with bunch of variables. I assume they are for authentication.
Which option is a right way to opt? I opt to choose token, as it is secure, I say, why burden server with the load client can handle when you can offload if token is used.
However, I have a feeling that tokens are basically not used in website, but only in APIs.