JWTs are great! You get to use your customer’s machine to store a lot of information about them and the session in a form they can actually read in most cases,

JWTs are great! You get to use your customer’s machine to store a lot of information about them and the session in a form they can actually read in most cases, and your don’t have to do a bunch of lookups each time they connect. Sure, you have to keep a revocation list, but you do anyway, for the same reasons. If you use short lived sessions with refresh tokens you get the Goldilocks scenario where a valid user stays logged in even when they are away for a long time, and you give them control over logging out instantly on all devices and access to the data you’re using about them.