Hi, author of the “don’t use JWT for sessions” article here.
I would take any articles from Auth0 with a grain of salt - they appear to have some vested interest in recommending JWT, and seem to spend a considerable chunk of their blog posts on recommending it in various ways. JWT tokens are absolutely not more future-proof than sessions - they are a different solution for a different problem. Implementing a blacklist system isn’t really a good solution, either - I’ve covered that in my follow-up post.
Similarly, storing it in Local Storage is just never okay, as it will open you up to session stealing. This is a problem that (HttpOnly) cookies do not have.
The summary is that there are no usecases where JWT are a good option for sessions - the only case in which it’s a valid choice is if you are scaling up so much that you just can’t have a centralized session store. It’s still not a good option, but stateless JWT (or similar stateless token schemes) are pretty much just the only option you have left.
EDIT: Of course, if there are no well-tested session implementations available for your stack, then a stateful JWT token can be a useful way to implement signed session IDs. But you’d still not store the actual session data in the token.
