[ascotan]

ergo: if it's ok to have an un-revocable insecure session - use JWT tokens.

[user5994461]

Or use JWT + OpenID Connect in a centralized mode, as the article explains toward the end.