>> IMHO the biggest argument against the use of JWT is that you can't easily invalidate JWT sessions That's true. JWT is great for WebSocket connections becaus

>> IMHO the biggest argument against the use of JWT is that you can't easily invalidate JWT sessions That's true. JWT is great for WebSocket connections because you can make the expiry really short (you could even make it 1 minute) and you could re-issue a new token in real-time every 50 seconds just before the previous one expires. Then if the user goes completely offline for 1 minute, then they lose their session (the JWT becomes invalid).