It's articles like these that make things more confusing for folks who are learning about auth/session security. It's obvious the author has developed strong convictions without really understanding the subject.
I can't make it past the first sentence:
> ...utilize JSON Web tokens (JWTs) for session handling instead of cookies.
One has nothing to do with the other. You can use a jwt and cookies. You can use a db session and use a jwt and not use cookies. Etc etc
I can't make it past the first sentence:
> ...utilize JSON Web tokens (JWTs) for session handling instead of cookies.
One has nothing to do with the other. You can use a jwt and cookies. You can use a db session and use a jwt and not use cookies. Etc etc