JWTs are frequently stored in LocalStorage which means that any XSS is able to leak the JWT. Cookies, on the other hand, can be configured to be HTTP-Only and

JWTs are frequently stored in LocalStorage which means that any XSS is able to leak the JWT. Cookies, on the other hand, can be configured to be HTTP-Only and inaccessible to JavaScript on the page. That prevents somebody with XSS from leaking the value without a second server-side vulnerability or weakness. In addition, JWTs are impossible to revoke without revoking _all_ sessions. This is the biggest weakness, imo, and the reason that they shouldn't be used client-side. I'm a huge fan of the approach the Ory is taking with Oathkeeper and Kratos: https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-identity-access-proxy https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-i...