JWT vs Session Authentication - Research Project

Comparative Analysis of JWT vs Session-Based Authentication in .NET: Performance and Security Evaluation

This solution contains a complete research project implementation comparing JWT and Session-based authentication methods in ASP.NET Core applications.

🎯 Project Purpose

Academic research project for AP9SI/AE9SI course focusing on:

• Performance comparison of authentication methods
• Statistical analysis with t-tests
• Security characteristics evaluation
• IMRAD paper preparation with real data

📁 Solution Structure

AuthApps/
│
├── JwtApp/                    # JWT-based authentication web app
├── SessionApp/                # Session-based authentication web app
├── AuthBenchmarks/            # BenchmarkDotNet performance testing
├── LoadTester/                # Concurrent user load testing tool
├── MetricsAnalyzer/           # Statistical analysis & LaTeX export
│
├── Results/                   # Auto-generated test results & reports
│   ├── *.csv                  # Import into Excel
│   ├── *.json                 # Raw test data
│   ├── *.txt                  # Human-readable reports
│   └── *.tex                  # LaTeX tables for Overleaf
│
└── Documentation/
    ├── RESEARCH_GUIDE.md              # Start here! Complete guide
    ├── QUICK_START_CHECKLIST.md       # Step-by-step checklist
    └── METHODOLOGY_TEMPLATE.md        # Copy-paste for your paper

🚀 Quick Start

1. Build Everything

dotnet build

2. Run Performance Tests

# Microbenchmarks (5-10 minutes)
cd AuthBenchmarks
dotnet run -c Release

# Load testing (20-30 minutes) - in 3 separate terminals:
cd JwtApp && dotnet run
cd SessionApp && dotnet run
cd LoadTester && dotnet run

3. Analyze Results

cd MetricsAnalyzer
dotnet run

4. Get Your Data

Check the Results/ folder for:

• ✅ CSV files for Excel graphs
• ✅ LaTeX tables for your paper
• ✅ Statistical analysis reports
• ✅ T-test results with p-values

📊 What You'll Get

Performance Metrics

• Response times (mean, median, std dev, percentiles)
• Throughput (requests per second)
• Memory usage
• Scalability under load (10-500 concurrent users)

Statistical Analysis

• Descriptive statistics
• Welch's t-test results
• P-values for significance testing
• Effect sizes

Ready-to-Use Outputs

• LaTeX tables → Copy directly to Overleaf
• CSV data → Create graphs in Excel
• Analysis reports → Reference in your paper

📚 Documentation

Start here: RESEARCH_GUIDE.md - Comprehensive guide with step-by-step instructions

For your paper: METHODOLOGY_TEMPLATE.md - Ready-to-use text for Methods/Results sections

Checklist: QUICK_START_CHECKLIST.md - Print and check off as you complete tasks

🛠️ Technologies Used

• Framework: ASP.NET Core 9.0 (Razor Pages)
• Authentication: JWT Bearer + Cookie Authentication
• Performance Testing: BenchmarkDotNet 0.15.8
• Statistics: MathNet.Numerics 5.0.0
• Data Export: CsvHelper, System.Text.Json

📖 Research Paper Structure

Your paper should follow IMRAD format:

1. Introduction: Background, research question, literature review
2. Methods: Implementation, testing methodology, statistical analysis
3. Results: Performance data, statistical tests, tables/graphs
4. Discussion: Interpretation, implications, limitations
5. Conclusion: Summary, recommendations, future work

Templates and examples provided in METHODOLOGY_TEMPLATE.md.

🎓 For Students

This project provides everything you need:

• ✅ Working implementations (JWT & Session)
• ✅ Automated testing tools
• ✅ Statistical analysis
• ✅ LaTeX table generation
• ✅ Paper templates
• ✅ Methodology documentation

You just need to:

1. Run the tests
2. Create visualizations from CSV data
3. Write your analysis and discussion
4. Prepare your presentation

🔒 Security Features Compared

Feature	JWT	Session
State	Stateless	Stateful
Storage	Client-side token	Server-side session
Revocation	Requires blacklist	Immediate
Scalability	Horizontal scaling friendly	Needs shared storage
Token Size	Larger (~200-500 bytes)	Smaller (~50 bytes)

📈 Expected Results

Based on typical findings (your results may vary):

• JWT: Higher initial overhead due to cryptographic operations
• Session: Faster validation but requires server state
• Scalability: JWT advantages in distributed systems
• Security: Both secure with proper implementation

⚠️ Important Notes

1. Run tests when computer is idle for accurate results
2. Keep apps running during load tests (don't close terminals)
3. Use Release configuration for benchmarks (-c Release)
4. Backup your Results/ folder before re-running tests

🆘 Troubleshooting

See RESEARCH_GUIDE.md section "Troubleshooting" for common issues and solutions.

📞 Support

For course-specific questions, contact your professor.

For technical issues:

1. Check RESEARCH_GUIDE.md
2. Verify all projects build: dotnet build
3. Check that ports 7275 and 7236 are available

🎯 Deliverables Checklist

• IMRAD research paper (PDF)
• Presentation slides (10-15 slides)
• Source code (this solution)
• Raw data (CSV files)
• Graphs/visualizations
• Statistical analysis reports

📄 License

This is an academic research project. Use for educational purposes.

🏆 Credits

Developed for AP9SI/AE9SI Software Engineering Research course.

---

Ready to start? Open RESEARCH_GUIDE.md for detailed instructions!

In a hurry? Open QUICK_START_CHECKLIST.md for a step-by-step guide!