coates’s Twitter Archive—№ 22,575

evertp I suspect this is because this method (in most cases) doesn't need to store anything on the server side, and better behaviour on load balancers. We mostly don’t use JWT, but we do store sessions as encrypted cookies (revokable by changing either a user token or a global token).