I think the rule of thumb should be to ALWAYS start with Cookies for client/server authentication, with all the security features enabled by default. HttpOnly,

I think the rule of thumb should be to ALWAYS start with Cookies for client/server authentication, with all the security features enabled by default. HttpOnly, Secure and SameSite. Then, if that has some sort of limitation for your app's specific use case, you can see to migrate to JWT. But the standards are standards for a reason.