JSON Web Tokens should be avoided
The criticisms of JWT seem to fall into two categories:<p>(1) Criticizing vulnerabilities in particular JWT libraries, as in this article.<p>(2) Generally criticizing the practice of using any &quot;stateless&quot; client tokens.  Because there&#x27;s no great way to revoke them early while remaining stateless, etc.<p>The problem is that both of these groups only criticize, neither of them can ever seem to actually recommend any <i>alternatives</i>.<p>I could care less about JWT <i>per se</i>.  I&#x27;m happy to implement a similar pattern with something else (e.g. store a secure cookie post-auth, skip all the refresh business and just let it expire when it expires, and employ an ugly revocation strategy only if absolutely necessary).  I don&#x27;t need JWT for this.<p>If I&#x27;m providing a REST API, then I&#x27;d prefer a token string that I could pass as a header value rather than forcing the use of cookies.  Although I suppose you could argue that a cookie is just another header value.<p>Either way, if you&#x27;re serving up a REST API to a JavaScript UI... what&#x27;s NOT a good option is server-side session state (e.g. Java servlet sessions).  That requires you to either:  configure your load balancer for sticky-sessions, or employ a solution to share session state across all your server-side instances (which never works very reliably).  Moreover, relying on a session isn&#x27;t a very RESTful auth strategy in the first place.<p>So if I&#x27;m writing a SPA in 2017, then I&#x27;m definitely taking a client-side approach and running afoul of the #2 critics.  And since JWT is so widely implemented (e.g. if I use a &quot;Login with Google&quot; option then I&#x27;m using JWT), I&#x27;m probably running afoul of the #1 critics too.<p>These criticism are fine, I guess.  There&#x27;s no faster route to blog clicks, book sales, speaker invites, and consulting dollars than: (1) telling everyone to jump on this year&#x27;s hype train, or (2) telling everyone that last year&#x27;s hype train sucks.  What the world really needs is a bit more actual prescriptive recommendations of what to do <i>instead</i>.