Session Store

systemdesign database/redis distributedsystem/microservice

Stateful & Stateless Applications
Redis + Session Store + Node js + Express Session Implementation

What is Session Storage?

Session storage is a way to persist user-specific data (like login state) across multiple requests in web applications.

Types of Session Storage

Type	Description
In-Memory (Server RAM)	Stored in app memory. Fast, but not scalable (lost on restart).
Redis / DB Session Store	Stores session data in Redis or a database. Scalable and persistent.
JWT (Stateless)	Stores session info in token (client-side). No server storage required.
Opaque Tokens + DB	Session ID stored on client, data stored in DB/Redis. Supports revocation.

Session Storage | Redis
Cache vs. Session Store - Redis

Comparison Table

Method	Stateless	Scalable	Revocable	Used In Microservices?
In-Memory	❌	❌	✅	❌
Redis / DB Session	❌	✅	✅	🚫 (adds coupling)
JWT	✅	✅	❌ (unless managed)	✅
Opaque Token + Redis	✅	✅	✅	✅

Best Practices

• Use JWT for fast, stateless access across microservices
• Use Refresh Token + Redis for session tracking and revocation
• Store only user ID or minimal data in sessions/tokens
• Always use HttpOnly and Secure flags for cookies
• For microservices: keep services stateless and independent

Diagram (JWT + Refresh Token with Redis)

sequenceDiagram
    participant Client
    participant AuthService
    participant Redis
    participant API

    Client->>AuthService: Login (credentials)
    AuthService->>Redis: Store refresh token
    AuthService-->>Client: Set JWT + Refresh token

    Client->>API: Access API with JWT
    API-->>Client: Returns data

    Client->>AuthService: Refresh token
    AuthService->>Redis: Validate token
    AuthService-->>Client: New JWT