JWT vs Sessions: Choosing Authentication for a Modern Web App

A few years ago, I inherited a codebase where every single API call carried a 4KB JWT stuffed with user preferences, feature flags, and a full permissions tree. Someone had read a blog post, decided s