They don't make a ton of sense until your public-facing services get kinda mesh-like. If it's all in one DB, including authorization and authentication data, an

They don't make a ton of sense until your public-facing services get kinda mesh-like. If it's all in one DB, including authorization and authentication data, and you never have one service requesting resources from other services on behalf of a user, they're probably overkill and regular sessions would be fine. (Nb. I've not personally seen them used in a case for which they make sense, yet, but only in smaller projects because they're trendy)