> Isn’t session token theft as much of an issue as JWT token theft? Session tokens can be revoked much more easily, say when a user logs out. A JWT token needs

> Isn’t session token theft as much of an issue as JWT token theft? Session tokens can be revoked much more easily, say when a user logs out. A JWT token needs a revokation service to revoke early, and that adds a fair bit of additional complexity. Also, assuming your client is a web browser (as is often the case) and you're sending the Authorization header, you have to store that JWT somewhere in the browser where it's not isolated from the rest of the scripts on your page (whereas session tokens are typically stored in opaque cookies with a lower chance of leaking to a malicious script). Though I imagine you can also store JWTs as cookies, which wold mitigate that issue.