> I can't think of any real world scenarios where a JWT is superior to cookie auth over HTTPS. I used it for cross-server auth sign-in to B.com from A.com > I

> I can't think of any real world scenarios where a JWT is superior to cookie auth over HTTPS. I used it for cross-server auth sign-in to B.com from A.com > It just sounds really awesome until you realize that, no matter what, you're going to need to keep and fetch some information about the user on the server, and that it's really not helpful at all to offload user data into a client side token I guess you always must unless you want to skip permission validation and stuff.