Why JWTs Suck as Session Tokens (2017)
I've read several articles along these lines now I tend to think the arguments are pretty weak.In this media rich age, the data size argument is a bit silly.The "you're going to hit the database anyway" argument whilst probably accurate in most cases, doesn't invalidate that JWT allows for one or more fewer database hits on every request.Having built-in integrity checking is definitely a feature.  Just because you can do it without JWT doesn't mean that it's not useful that JWT does it.IMHO the biggest argument against the use of JWT is that you can't easily invalidate JWT sessions.  Should you need to dump a users session or if the information contained in that session token has become invalid then you might be in trouble.  For my use cases so far however this hasn't been a problem.JWT is a fine solution for quite a lot of use cases.  As with everything tech, just be aware of the limitations and choose wisely.