JWTs have long been a favourite topic of software engineer bloggers as they do raise a lot of interesting technical questions. Whether we can take this as evid

JWTs have long been a favourite topic of software engineer bloggers as they do raise a lot of interesting technical questions. Whether we can take this as evidence of a big following in actual production implementations I’m not so sure, but if forced to guess I suspect they are exceedingly rare (compared to stateful systems) outside of programmer side projects. I’ve rarely ever seen stateless auth used on anything serious, as others have noted many times before the issues with invalidating previously issued tokens often removes the “stateless” part, after which you are just as well using more traditional mechanisms.