JWT is at the heart of OpenID connect, I agree they’re still perfectly reasonable. The big issue I have with JWT is they are hard to invalidate for security re

JWT is at the heart of OpenID connect, I agree they’re still perfectly reasonable. The big issue I have with JWT is they are hard to invalidate for security reasons, but if you lower the validity and refresh the token more often you can mitigate (not eliminate) the risk.