security for web applications session vs token

Question

Background:
I am developing a web application, planned to use spring-mvc and spring security. My plan is to use form based authentication where spring security authenticates credentials and sets a session JSESSIONID so that subsequent requests would be authenticated based on the cookie present in request header.

My understanding:

• Web applications requests should have state. This state can be accomplished by using the session.

• Purely session based authentication are vulnerable to CSRF attacks. As spring security provides CSRF protection, i didn't find any security loop holes using session + CSRF protection.

• access-tokens are only used to give access to APIs which has been exposed for third party applications.

My Question:
But when i see lot of questions in this site, people are using token(OAuth2/JWT) based authentication for web application. But what i believed is tokens are only used to give access to APIs.

But when i see people using tokens for web applications i just got this question. Assuming token based web applications does not uses session but expects token in the header of every request.

1. When we should go for token based authentication in web application.

2. As far as security is concerned, which one is good? Session + CSRF or token based authentication.

I am confused with use cases of token and session.

EDIT:

_{From momo's comment}

Most often, it depends on your clients.
For example, for mobile clients (e.g. JSON payload over HTTP), there is no such thing as a Session. JWT has the advantage to work cross-origin. In contrast, a Session-based auth method with Cookies works only for the same (Sub)-domain) and scales not that well.
However, it is easier to invalidate a Session than a JWT. Since you anyway use Spring-MVC and i guess scalability is not critical, just go with the one you are more comfortable.

---

conclusion: Session supports requests only from same origin, token based authentication preferred for authenticating cross origin requests.

Answer 1

Most often, it depends on your clients. For example, for mobile clients (e.g. JSON payload over HTTP), there is no such thing as a Session.

JWT

• JWT has the advantage to work cross-origin over different domains
• Therefore, JWT based authentification scale better
• very popular in the age of single-page applications (SPA) / Web API's
• keep attention to integrity protection by using either a signature or a MAC. Do not allow the unsecured JWTs: {"alg":"none"}

Session

• primarily used in conjunction with web browsers
• Easier to invalidate (remove) a Session. JWT has only an expiration date and is valid until it expires
• keep attention to the following cookie attributes: secure; HttpOnly and to provide some protection against cross-site request forgery attacks: SameSite=Strict or SameSite=Lax

Other approaches: Open Source Identity Providers like Keycloak with e.g. traefik as load balancer have become quite popular. This brings the advantage, that new routes can go live without restarting any service. Also, in some cases, it saves application downtime caused due to an excessive rate of API calls.

To conclude: Many roads lead to Rome. It always depends on the specific requirements, the environment and the skills of the team. Since you anyway use Spring MVC and I guess scalability is not critical, just go with the one you are more comfortable..

Answer 2

• For Stateless application use JWT
• For third party applications use OAuth2
• For Statefull application use Session + CSRF