If you store a JWT in a secure https only cookie, you get most of the security pros of the session token, but not the downsides. You are still stateless. Yes, d

If you store a JWT in a secure https only cookie, you get most of the security pros of the session token, but not the downsides. You are still stateless. Yes, do not store JWTs in localStorage or such, this is not good practice. If a session tokens gets stolen, you eventually are able to revoke it, but in real life you won't, because you won't recognize the theft in most of the cases. On the other hand, with JWTs you are still able to block database access for the specific user, when it comes to a case of identity theft. This mitigates also. The article is optioniated and vague, which is absolutely fine. :-)