The same criticism can be leveled against a signed session token. Also comparing decryption with a local redis get which is still much slower is wrong. The crit

The same criticism can be leveled against a signed session token. Also comparing decryption with a local redis get which is still much slower is wrong. The criticism against long expiration is valid but that is not unique to JWT, and token refresh is not a "patch" on a broken system. This is just way off on everything