It's an interesting reading (together with second part), but should be taken with a grain of salt. Stateless sessions are useful under load and not necessarily

It's an interesting reading (together with second part), but should be taken with a grain of salt. Stateless sessions are useful under load and not necessarily under reddit-size load. I like 2-layered setup actually with long-expiration (1 year) "session" cookie kept on `auth.example.com` domain and short-lived (1 hour) JWT-cookie kept on `example.com` domain. JWT can optionally include permission for dangerous operations which is not automatically granted. You still need redis to take care of forceful expiration, but that would be very simple call to the small list (1 hour of force-expirations if you reissue jwt-tokens on hourly basis), not data-fetching calls. We can keep this in a tiny redis-cluster colocated with frontend machines. JWT would have enough data to personalize cached templates. This will render really fast. API-backend, database and larger redis-storages can be kept deeper in logical server-room and be accessed only on cold requests