Is it secure to authenticate a user using the JSessionId that the client passes to the server ?
Assume that in a Spring app, we store the jsession id for a user that provided correct credentials while logging in, in a database and we authenticate each subsequent request based on that jsession id.
Does this method provide the same security level of using Java Web Tokens ?
JWT tokens are cryptographically signed so they are much more difficult to forge compared to session IDs.
Session IDs are generated using a secure random number generator which may be predicable depending on the implementation.
https://news.netcraft.com/archives/2003/01/01/security_advisory_2001011_predictable_session_ids.html
Some more information on why JWT is preferable over session IDs may be found here: