> Isn’t session token theft as much of an issue as JWT token theft? I think the author focused too hard on the association between JWT and how they are sent th

> Isn’t session token theft as much of an issue as JWT token theft? I think the author focused too hard on the association between JWT and how they are sent through the Authorization header, and session tokens and how they are stored as cookies. My guess is that the author confuses session tokens with a very specific frontend implementation of session tokens, and proceeds to base his comparison on those contrasts.