Cookie Auth vs Bearer Token in Express – What's the Difference and When to Use Each?

M.Nadeem Shakoor — Thu, 19 Jun 2025 11:21:12 +0000

When building secure Express.js applications, you’ll likely face a key architectural choice:
Should you use cookie-based authentication or bearer tokens like JWTs?

Each method has unique advantages depending on your frontend, deployment, and security requirements. In this post, we’ll break it down clearly and practically.

Why It Matters
Defines how your app handles sessions and security
Impacts frontend integration, especially for SPAs
Affects protection against attacks like CSRF and XSS
Determines whether tokens are sent automatically or manually
Option 1: Cookie-Based Authentication
How It Works
Server sets a cookie containing a session ID or JWT
Browser stores it and automatically sends it with every request — if configured correctly
res.cookie('token', jwtToken, {
httpOnly: true,
secure: true,
sameSite: 'Strict'
});
To access it:

import cookieParser from 'cookie-parser';
app.use(cookieParser());

app.get('/dashboard', (req, res) => {
const token = req.cookies.token;
});
When Are Cookies Sent Automatically?
Cookies are included in requests when:

The origin matches the cookie's domain
sameSite allows the request (Lax, Strict, or None)
credentials: 'include' is used in fetch/axios for cross-origin requests
Connection is over HTTPS if secure: true
fetch('https://api.example.com/user', {
credentials: 'include'
});
Option 2: Bearer Token Authentication (JWT)
How It Works
Client stores token manually (e.g., in localStorage)
Token is explicitly added to the Authorization header
fetch('/api/protected', {
headers: {
Authorization: Bearer ${token}
}
});
On the backend:

const authHeader = req.headers.authorization;
const token = authHeader?.split(' ')[1];

My small side project: a short URL tool with domain support, stats & link protection

M.Nadeem Shakoor — Thu, 19 Jun 2025 10:58:34 +0000

Hey folks,

I recently built a tool called Uplinkly – it’s a short link manager that allows you to:
•create short links with your own domain
•view click stats
•generate social preview (OpenGraph)
•and even protect links via Cloudflare

It started as a personal experiment, but now it’s almost a fully working tool. Not a commercial push — just wanted to share in case someone finds it useful or has feedback.

👉 https://uplinkly.net

If you have a few minutes to check it out and click around — I’d be super grateful! And I’d love to hear what you’d improve or expect from a tool like this.

Top comments (0)

Subscribe
pic
Add to the discussion

DEV Community: M.Nadeem Shakoor

Cookie Auth vs Bearer Token in Express – What's the Difference and When to Use Each?

My small side project: a short URL tool with domain support, stats & link protection