This is interesting because one thing people ask me when a system is using JWT is in case they reset their password, how can they invalidate all existing sessions? They basically can’t.
Using A cookie-based/token-based session strategy, you can do that quite easily.
Using A cookie-based/token-based session strategy, you can do that quite easily.