JWT isn't necessarily a complete solution as it lacks revocation. That can be handled in other ways, but some people insist on discouraging it rather than telling you how to properly handle them.

Interesting ask recently regarding it.

https://news.ycombinator.com/item?id=18767767