> JWT is awesome. That's generally my thought, too. In my career the authentication sophistication was always a trade off (effort vs security) based on how par

> JWT is awesome. That's generally my thought, too. In my career the authentication sophistication was always a trade off (effort vs security) based on how paranoid the org felt about certain things. Having worked on PHP/Rails/.NET Webforms/Node.js apis/C# webapis the session management techniques are all very different. Having run high traffic websites also, the ability to offload logged-in sessions into JWT was really, really nice. Not having to prune auto-generated sessions from disk of PHP applications is a nice thing to not worry about.