Why JWTs Suck as Session Tokens (2017)
I've read several articles along these lines now I tend to think the arguments are pretty weak.<p>In this media rich age, the data size argument is a bit silly.<p>The "you're going to hit the database anyway" argument whilst probably accurate in most cases, doesn't invalidate that JWT allows for one or more fewer database hits on <i>every</i> request.<p>Having built-in integrity checking is definitely a feature.  Just because you can do it without JWT doesn't mean that it's not useful that JWT does it.<p>IMHO the biggest argument against the use of JWT is that you can't easily invalidate JWT sessions.  Should you need to dump a users session or if the information contained in that session token has become invalid then you might be in trouble.  For my use cases so far however this hasn't been a problem.<p>JWT is a fine solution for quite a lot of use cases.  As with everything tech, just be aware of the limitations and choose wisely.