I dont think any of the major elixir auth libraries (which is really what we are talking about) advocate completely replacing session management with JWT claims. That is kind nuts, since you often store privileged information in a session, and JWT by design are readable by the client.
They do advocate for using JWT to authorize sessions, or to support sessionless workflows, since most elixir apps have an api, websockets, and web for the same user.
Your solution assumes you control the services that you are consuming that is not often the case. If we have universal solution across many systems we either have to support and/or integrate with that reduces the cost makes things simpler (even if the solution is not ideal).
Even if you do not control the services, that doesn’t mean that you need to use their authentication scheme everywhere. You just use their scheme where absolutely required, model your own system around sessions, and hand out tokens for other services where necessary. It’s still the same principle.
I’m not saying one thing is better then another, im actually arguing against the idea that there is one golden hammer. Everything has tradeoffs in authentication, you can list the negatives of anything and come to the conclusion it is bad. And be right! But there is also good.
Modern webapps tend to be written in something that lives on the browser, and communicates with the server via API. They also tend to have mobile apps, as well as public APIs. Phoenix apps tend to use websockets (channels). JWT works well for all of those cases, while session id in a cookie matching a row in a db work well for html forms. So authentication gets a lot easier for the other cases, and the tradeoff is invalidation gets more complicated. Are session cookies bad because they are really clunky to use in non browser situations? Of course not. Its all about tradeoffs and using the right tool for the job.
