I probably got down-voted because I conflated cookie with session token cookies. You can of course have a cookie that does not require a database lookup to vali

I probably got down-voted because I conflated cookie with session token cookies. You can of course have a cookie that does not require a database lookup to validate. But JWT takes care of having the expiry signed in the value (in a cookie the expiry is more of a suggestion that a modified client could ignore). Combine that with low expiry JWT tokens and high expiry refresh tokens (subject to more validation) I think it is a clear winner.