JWT is a token, often stored as a cookie. This is both true and also misses the point. Session Cookies are ususally stateful. In other words, the server valida

JWT is a token, often stored as a cookie. This is both true and also misses the point. Session Cookies are ususally stateful. In other words, the server validates the session by querying a service or database. JWTs however are stateless. You don't query a service or database to validate the service. As a consequence if the JWT is not expired and is still using a valid key there is no out of the box way to invalidate the JWT. You can build custom invalidation measures on top of JWT but it's not a natural consequence of the design in the same way that a session cookie is.