Session Cookies vs JWTs: Least-Privilege Auth with Expired Credential Detection in Appwrite

Authentication mechanism trade-off for least-privilege access

Appwrite offers two primary authentication paths: server-managed session cookies (httpOnly, same-site) and client-managed JWT Bearer tokens with a project-wide configurable expiry (default one hour). Both integrate with document-level permission checks (read("user:"), write("role:admin")) evaluated at request time, but they diverge sharply on platform support and expired-credential handling.

Constraint: distinguishing expiry from invalidity without refresh tokens

• Session cookies enforce least-privilege automatically via browser same-origin policy and CSRF protection, yet they are unavailable to native mobile apps, cross-domain SPAs, and server-to-server calls.
• JWTs work across all clients but require developers to implement secure storage, manual refresh logic, and token rotation — Appwrite issues no refresh tokens and provides no automated rotation.
• Both expired sessions and expired JWTs return a generic 401 with no error code or claim indicating why authentication failed (expiry, revocation, malformation, or clock skew).

This forces a choice: accept cookie limitations for simpler expiry UX (browser handles renewal silently), or adopt JWTs for universal client support and build custom expiry detection (e.g., decoding exp claim client-side) while handling the increased attack surface of longer-lived or frequently refreshed tokens.

Open questions

1. For a multi-platform product (web, iOS, Android, server workers), is the operational burden of custom JWT refresh and expiry detection justified over running separate Appwrite projects per domain to keep cookie-based auth?
2. Can a hybrid approach — cookies for web, short-lived JWTs with client-side exp checks for native — maintain least-privilege guarantees without duplicating permission logic?
3. Does Appwrite's roadmap include a standardized WWW-Authenticate challenge or error payload that distinguishes token expiry from revocation, enabling silent refresh vs. forced re-login UX?