JWT is excellent for: stateless API authentication across services, short-lived access tokens, and cross-domain authentication.
It is poorly suited for: long-lived user sessions, tokens you need to invalidate before expiry (logout, password change, account suspension).
The canonical misuse: a web application uses JWT as its session mechanism, stores the token in localStorage, issues tokens with a 30-day expiry, and discovers there is no mechanism to log a user out.
The correct pattern for web sessions: server-side sessions with a session cookie. Use JWT for API authentication with short expiry (15 minutes) and a refresh token rotation system.
— Dick Bassey | DevDick | 2023