The downside is that JWTs are more tricky to revoke, other than the standard "this is valid for 24 h
The downside is that JWTs are more tricky to revoke, other than the standard "this is valid for 24 hours". If that's a concern you can always do a DB lookup on sensitive actions like password changes, while allowing regular JWT validation on standard actions.
