Stop Using JWTs

Most of the useful discussion landed on a narrower rule: stop using JWTs as the primary browser session mechanism, not “stop using JWTs” full stop. For service-to-service auth, identity provider issued access tokens, and cases where one party mints claims and another party validates them offline, people still see JWTs as a practical tool. The recurring distinction was browser user sessions versus machine-to-machine trust. Cookies are not magic either. They trade the localStorage replay problem for the usual XSS and CSRF concerns. But an HttpOnly cookie at least prevents an injected script from stealing the credential and reusing it elsewhere, which several commenters saw as the important difference. A second thread cut through the usual “stateless” sales pitch. Once you need logout, compromise response, per-device invalidation, or current authorization checks, you are back to keeping state somewhere. That can be a revocation list, a per-user “not valid before” timestamp, or a database lookup for user status. At that point, many commenters said the simplicity edge shifts back to classic sessions. The thread was not fully anti-JWT though. Several people argued that a small replicated revocation structure can still be easier than globally consistent session storage when you have services spread across regions. The practical consensus was straightforward: JWTs are fine when you actually need portable signed claims. They are usually overkill, and often a foot-gun, for ordinary browser login.