Not a huge fan of this article (despite being a huge fan and consumer of Okta). The author is making a number of assumptions that are bad architectural practice

Not a huge fan of this article (despite being a huge fan and consumer of Okta). The author is making a number of assumptions that are bad architectural practices these days. These include: 1) Stateful services everywhere (assuming you always have a database) 2) That you are only doing interactive sessions, and not web services 3) That you have a single issuing authority that is non-federated For stateful CRUD applications that don't need to scale, and have a centralized authority, by all means, use session cookies. If, on the other-hand you have a application that needs multiple authentication sources, has a API on the other end that doesn't want to know a separate authentication path, or run stateless functions, JWT is a fairly good choice. For most modern applications, session cookies create far more problems then the simple universal decision to use JWT across the board.