From what you have said I assume you are building server side application, if not, that would basically invalidate this response. With that assumption intact, sessions are definitely the way forward. They are easier to deal with and reduce the logic needed. I would always go for the simpler option.
Just to be clear, JWTs are not insecure. Uses of JWT's are insecure. There are implementations of OAuth2 that use JWTs, can invalidate the token, and are secure.
Nicholas Wiersma
Software developer, general human being.
As with most things, this depends on your use case. In API's JWT is the probably a better choice. In a front end server side application sessions are probably the right path. That being said, there are use cases where you need to use JWT instead of sessions and visa versa. There is no one way with this.