What is the core trade-off between session and token-based authentication?

Short interview answer

Sessions keep authorization truth in server-side state, making revocation immediate but requiring shared or replicated storage across servers. Tokens are self-contained and verifiable without a lookup, scaling better across services, but revoking one before expiry needs extra mechanisms.