> > ...utilize JSON Web tokens (JWTs) for session handling instead of cookies. I read that as JWTs in a cookie as a replacement for session cookies with data s

> > ...utilize JSON Web tokens (JWTs) for session handling instead of cookies. I read that as JWTs in a cookie as a replacement for session cookies with data stored on a server. There are nice things about that, but with a fail safe logout mechanism via server side revocation lists JWTs are not that stateless anymore. EDIT: I do agree that the article misses the point a bit, but I also agree with the article that sessions cookies are wonderful and you almost always should use that instead. It all depends on your environment. One thing I can say: never use Active Directory as a token server the amount of glue you need is insane.