We don't use JWT because we are NOT google scale.
A centralized database for sessions, and we can extend/revoke any token anytime.
A centralized database for sessions, and we can extend/revoke any token anytime.
I'd argue that people who need to avoid hitting their database on every request outnumber people who need sub-minute revocation