[coder543]

You can store a JWT in a session cookie. You don’t need a SPoF for session validation, if that’s not what you want.