> If you are doing a MPA, I would only use a session cookie and set the secure only flag as well as the same origin flag for the cookie.

I am doing an MPA. I am setting a session cookie, the secure only flag and the origin flag. But I am using JWT to store the ephemeral session id which is then compared on the server-side to the session cookie as a cross-check. A new JWT with new id is created for each request. That way the server remains stateless and the client gets new token back for each request; this token is then used in the next request. The only question I have is what are the disadvantages of doing this i.e. making each request independent of the other requests and then cross-checking the validity of incoming request by comparing id stored in the JWT with the one stored separately in another cookie.

> Httpd is pretty hardened and they are plenty of auth solutions for it, if you are using it.

I am not using httpd.