> What exactly is the scenario you envision in which JWT is all someone has? Do you mean they're forced to use stateless session management, or that JWT is lite

> What exactly is the scenario you envision in which JWT is all someone has? Do you mean they're forced to use stateless session management, or that JWT is literally all they can do for authentication because nothing else is available? Good luck using session cookies with Cordova on iOS, for example [1]. In cases like these JWT is perhaps your only option. [1] https://issues.apache.org/jira/browse/CB-12074 https://issues.apache.org/jira/browse/CB-12074