Also important to remember is that even when someone thinks JWT will allow avoiding database lookups they eventually still add them for one reason or another (e

Also important to remember is that even when someone thinks JWT will allow avoiding database lookups they eventually still add them for one reason or another (e.g. for instantaneous token revocation). Macaroons look nice and simple on the surface but have many edge cases that are not at all supported by the existing libraries or have bad/insecure defaults. For random keys it's good to remember that plain lookup in the database is prone to time side channel attacks, see https://paragonie.com/blog/2017/02/split-tokens-token-based-authentication-protocols-without-side-channels https://paragonie.com/blog/2017/02/split-tokens-token-based-...