To be fair, 90% of the time i see people recommend JWT for auth, it's a session token inside a jwt in a cookie, which then gets decoded and checked against the

To be fair, 90% of the time i see people recommend JWT for auth, it's a session token inside a jwt in a cookie, which then gets decoded and checked against the db in the backend