[homebrewer]

Cookies can be encrypted and signed and contain whatever information you want, not just some random token that has to be looked up in the database to be actually useful.

This is what aspnet core does by default if you enable cookie-based authentication. Gives you the best of both worlds.