> I have mostly stuck to plain old server side sessions that are easy to revoke. But you have implicitly made a tradeoff. Your front-end infrastructure now ha

> I have mostly stuck to plain old server side sessions that are easy to revoke. But you have implicitly made a tradeoff. Your front-end infrastructure now has a very strong dependency on your auth server. Any minor hiccup in the auth system will blow up your downstream clients. Worse, in large sites you will be sending a ton of traffic to your auth server. You've also introduced a source of latency to your page-load times as each request now needs to call the auth server to validate the token. Whatever the response time of the auth system now gets added to the front-end response time. Going with tokens that can be validated on the front-end system can dramatically lighten load on your auth system and reduce your front-end response time. The only major trade-off is you can't kick somebody out instantly. The bad-actor can do whatever until the token expires--a knob you control. And even then, for shit that matters, you can always have the front-end server validate the auth token on each request anyway.