JWT.

the two-minute refresher

• The server signs {user_id, roles, exp}; the client sends it back on every request.
• Verification is a signature check: no storage and no network call.
• Weaknesses: you can't invalidate a session before it expires, and key rotation is complex.
• Size is capped by the cookie (about 4 KB) and the whole session travels on every request.