"about session usage of JWT since it has little value "
Two weeks ago, I stood in front of a room full of senior developers and architects and asked them "How will we avoid making a leading 'Does the user have permissions?' call or wrapping the request in a try catch in case the user doesn't have access without JWT claims.
They all got mad. Then they conceded that they don't have a solution. Do you have a solution? If not, you can't replace JWTs.
Two weeks ago, I stood in front of a room full of senior developers and architects and asked them "How will we avoid making a leading 'Does the user have permissions?' call or wrapping the request in a try catch in case the user doesn't have access without JWT claims.
They all got mad. Then they conceded that they don't have a solution. Do you have a solution? If not, you can't replace JWTs.