STOP USING JWTS

Summary from the TLDR Dev newsletter

JSON Web Tokens should be avoided for managing user sessions because they are insecure and were never intended for long-term authentication. Traditional cookie sessions are a more reliable alternative, with better flexibility and protection against common security vulnerabilities. Truly stateless authentication is largely impractical, as secure token management usually requires a persistent data store to handle revocations and expiration properly.