Which is most used or followed approach while creating authentication for application? 1) JWT + localstorage 2) JWT + httpOnly cookie 3) httpOnly cookie + session

cant comment on which is mostly used but we use httpOnly cookie + sessionId

We use JWT + httpOnly cookie

@silly-sundown-88321 In nodejs or java what is tech stack?

java

@silly-sundown-88321 For microservices or multi tenant based architecture is session auth with httpOnly cookie suitable?

yeah we use it the same way, each and every api call authenticates the user. If there is a downstream api that needs to be called we pass the sessionId to the downstream microservice.

@silly-sundown-88321 From scalability & performance point of view is session based auth using httpOnly cookie good? As we are going to validate user on every request to check in DB if it is valid session or not