Another person claimed by the JWT hypetrain... Stop using JWT's for sessions. Here's a great resource for every counterargument you could possibly think of