JSON Web Tokens should be avoided
The criticisms of JWT seem to fall into two categories:<p>(1) Criticizing vulnerabilities in particular JWT libraries, as in this article.<p>(2) Generally criticizing the practice of using any "stateless" client tokens.  Because there's no great way to revoke them early while remaining stateless, etc.<p>The problem is that both of these groups only criticize, neither of them can ever seem to actually recommend any <i>alternatives</i>.<p>I could care less about JWT <i>per se</i>.  I'm happy to implement a similar pattern with something else (e.g. store a secure cookie post-auth, skip all the refresh business and just let it expire when it expires, and employ an ugly revocation strategy only if absolutely necessary).  I don't need JWT for this.<p>If I'm providing a REST API, then I'd prefer a token string that I could pass as a header value rather than forcing the use of cookies.  Although I suppose you could argue that a cookie is just another header value.<p>Either way, if you're serving up a REST API to a JavaScript UI... what's NOT a good option is server-side session state (e.g. Java servlet sessions).  That requires you to either:  configure your load balancer for sticky-sessions, or employ a solution to share session state across all your server-side instances (which never works very reliably).  Moreover, relying on a session isn't a very RESTful auth strategy in the first place.<p>So if I'm writing a SPA in 2017, then I'm definitely taking a client-side approach and running afoul of the #2 critics.  And since JWT is so widely implemented (e.g. if I use a "Login with Google" option then I'm using JWT), I'm probably running afoul of the #1 critics too.<p>These criticism are fine, I guess.  There's no faster route to blog clicks, book sales, speaker invites, and consulting dollars than: (1) telling everyone to jump on this year's hype train, or (2) telling everyone that last year's hype train sucks.  What the world really needs is a bit more actual prescriptive recommendations of what to do <i>instead</i>.