[jayd16]

Sessions could be stolen too. The rest are essentially trade offs with the expiration mechanism. If your use case can't handle that, don't use JWT.

[ascotan]

ergo: if it's ok to have an un-revocable insecure session - use JWT tokens.

[user5994461]

Or use JWT + OpenID Connect in a centralized mode, as the article explains toward the end.