CSRF vulnerabilities are less severe than a stolen session. I've addressed the reason for that here: https://www.reddit.com/r/PHP/comments/4nwpvg/stop_using_jwt

CSRF vulnerabilities are less severe than a stolen session. I've addressed the reason for that here: https://www.reddit.com/r/PHP/comments/4nwpvg/stop_using_jwt_for_sessions/d47larg https://www.reddit.com/r/PHP/comments/4nwpvg/stop_using_jwt_... > This is only true if you are using cookie headers to send the token (which is less common), not if you only use it for storage/retrieval of the token. That's the normal mode of operation for cookies, and what you should assume the client to do. > Lastly, he argues JSON web tokens are not easier to use, but then points out you need a dedicated Redis session store server to scale session authentications. At a scale where you can't just store the sessions in the database you're already using (or on disk - see PHP), the added complexity of a single Redis server is negligible. Below that scale, you can just use your regular database, at no additional complexity cost. > Managing sessions in mobile apps and command line apps is a huge pain compared to JWTs. I've heard a few people claim this now, but none have been able to explain exactly how it's a "huge pain" or "more complex". Care to elaborate?