I think we're in agreement. We need our session tokens (Whether a random session ID or a JWT) to be able to be invalidated, which requires server-side state, b

I think we're in agreement. We need our session tokens (Whether a random session ID or a JWT) to be able to be invalidated, which requires server-side state, but proponents of JWTs advertise statelessness as being a feature. Granted, with JWTs, you'd only need to store a blacklist of invalidated tokens, whereas with plain session IDs, you need a database storing the data for every active session, so JWTs can still be used to minimize state.