The method of authentication preferred for your project solely depends on your project's requirements. Both token and cookie based approaches have their own list of pros and cons. Nest.js as a framework gives you the ability to achieve both of these approaches.

Cookie based authentication

• This is a stateful approach.

• Server authenticates the client, sends out a signed cookie to the client and opens a session. The client sends the cookie along with every subsequent request for authentication.

• Server maintains the session information in this approach. The session is flushed out after the client logs out.

• Cookie based authentication requires no setup in the client side. Browsers handle that by default. You can also set the cookies to be HttpOnly which makes them inaccessible to the client side javascript, ensuring security.

• Cookies are strictly locked to a specific domain. You cannot use cookies between domains, as the session lies on the server.

Token based authentication

• This is a stateless approach.

• Server authenticates the client and sends out a signed token back to the client, which contains the hashed secret key. Client attaches the token in the header of every request, which is parsed and verified by the server to ensure integrity.

• This requires setup in the client side to manage the token. The client is responsible for storing and updating the valid token.

Conclusion

• HTTP is a stateless protocol. Token based approach ensures integrity of the client and also ensures a stateless approach. Cookie based authentication results in stateful sessions between client and server.

• Tokens can be shared across domains, ensuring a good fit for microservice architectures unlike cookies, which are specific to a domain.

Token based approach results in a more flexible approach, though it requires some manual code to be written from your side.