Ask HN: What's the current sentiment on JWT for stateless auth tokens?
JWT were aiming to be stateless, yet they cannot be stateless if you need them to be revocable. If you keep using plain sessions you got a SPOF, but you are immune, for a whole lot of consistency and cred management problems.<p><a href="http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work/" rel="nofollow">http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...</a>