@rune Judging from my experience with the "stop using JWT for sessions" article I wrote, that's probably not the worst idea.

Half the internet kept bringing up "counterarguments" that were already addressed *in the article they were commenting on*.

The moment I published a follow-up with a flowchart (yes, a real one), all that dried up overnight.