Performance and Tail-Latency Trade-offs Between Stateless JWT and Stateful Session Authentication Under Increasing Concurrency

Abstract

Authentication architectures impose critical operational constraints on web service scalability. While stateless JSON Web Tokens (JWT) are operationally convenient, continuous cryptographic verification introduces computational overhead. Conversely, stateful session authentication shifts this cost to session-store access, introducing network I/O latency. This paper presents an empirically validated, full-spectrum benchmark comparing HMAC-SHA256 JWT validation against a cache-oriented stateful session architecture. Load was generated using Autocannon scaling from 10 to 250 HTTP/1.1 connections in a controlled Node.js environment, with high-resolution 10-run evaluations isolating the specific crossover boundary (175–225 connections). To model realistic network caching constraints, stateful validation included a synthetic 10ms asynchronous delay, while JWT bypassed this delay via direct CPU verification. The results establish a highly conditional performance narrative. At low concurrency (10 connections), JWT outperformed the stateful model in throughput by over 15x (9,861 RPS vs. 645 RPS) with sub-millisecond mean latency. However, as load scaled, the stateful session architecture demonstrated superior linear throughput scaling, overtaking JWT at approximately 200 concurrent connections. At peak load (250 connections), CPU contention caused substantial tail-latency degradation for JWT (p99 of 177.3 ms), whereas stateful sessions maintained highly stable tail behavior (p99 bounded at 36.0 ms). The findings confirm that neither architecture is universally superior: JWT is optimal for low-latency, low-concurrency environments, while stateful session caching provides essential stability and resilience under sustained high load.