I think the most important part of that is "you're going to hit THE database". A single session token is more efficient but tightly couples all services. There'

I think the most important part of that is "you're going to hit THE database". A single session token is more efficient but tightly couples all services. There's a single point of failure at whichever server does auth. Unlike JWTs, degradation or outages in token servers ripple through the whole system. So when would you use session tokens? When you have a small application that you confidently predict will never outgrow being a monolith.