I’m still not understanding the advantages of JWT over cookies for user facing auth.
I do see use cases for JWT for machine-to-machine auth though.
I do see use cases for JWT for machine-to-machine auth though.
The chief difficulty this introduces is manually invalidating tokens. You end up having to store some data and/or ask some other system questions about users (blacklist-related, in either case) after all, reducing the initial benefit. But distributed sessions will run into similar problems anyway.
Basically if your auth lives the same place as all parts of your application the user will ever see, don't bother with it because the benefit is little to none, otherwise, JWT's a solid maybe.