49 minutes from now
JWT for Sessions
At some point JWTs became the default answer to "how do I keep a user logged in." For most applications it was the wrong choice. A JWT's headline feature is that the server does not remember it, which is the same sentence as "the server cannot forget it" — so you cannot revoke a session when you need to. Add the algorithm confusion attacks the format invites, and the boring opaque session cookie turns out to be safer, simpler, and revocable for anything that does not need stateless cross-boundary verification.