But then how are JWT different from opaque session tokens? Both still need server side checks for anything The truth is that JWTs have always been meant for au

But then how are JWT different from opaque session tokens? Both still need server side checks for anything The truth is that JWTs have always been meant for authorization, they just were applicable to very few cases almost exclusively at Google scale