I've used mostly JWT, the tokens with a short TTL which makes it easier to control revoking/banning in the backend. It is really simple to set up. In the front

I've used mostly JWT, the tokens with a short TTL which makes it easier to control revoking/banning in the backend. It is really simple to set up. In the frontend it's pretty straight forward to implement logout and other common behaviors even if the token is still valid because of the TTL.