Randall Degges has a blog post on this. It's pretty good actually: https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-...