- Using JWT tokens for browser sessions seems moot, because if you are storing a jwt token in the session you may as well store the user_id and make things simpler. If the session storage is cookie based, it is still safe because the cookies are signed and phoenix will blow up if you tamper the cookie.
- Using JWT tokens for API access seems reasonable, However, you don’t get the flexibility to invalidate them.
- Some people store the JWT token in a database and return another uuid which lets you look up the JWT token, this completely defeats the purpose of JWT.
Like the blog article linked above, I think JWT makes sense when you have 2 independent applications which need a way to authenticate without talking to each other. It makes more sense if you use public keys on sending server and the private keys on the receiving server for authentication.
