What practices would that be? Both good and bad is interesting to me. I recently decided against using jwt bearer tokens due to the concerns expressed in both

What practices would that be? Both good and bad is interesting to me. I recently decided against using jwt bearer tokens due to the concerns expressed in both rfcs and owasp of being to risky when compared to session cookies. But really I’m wondering if the risk of screwing up csrf protection isn’t more of a concern than token leaks.