JWT 사용을 중단하라

This article argues that using JWT for browser-based user sessions is a fundamental security mistake, as JWT is designed for short-lived tokens (under 5 minutes) while sessions require longer lifespans. The author demonstrates that truly stateless authentication is impractical to implement securely, and advocates for traditional cookie-based sessions as a more efficient and secure alternative. For cases requiring short-lived signed tokens, PASETO is proposed as a better-designed specification.