My critique with POST /login is that it's a verb, not a noun. Whether the session is stored on the server or the client is the same regardless of the verbiage.

My critique with POST /login is that it's a verb, not a noun. Whether the session is stored on the server or the client is the same regardless of the verbiage. In both cases a client-side session is a bit of semantic abuse but HTTP does not have verbs for creating resources on the client. I think a JWT token represents a session, since it can expire and be disposed when logging out.