JWT: Not a Silver Bullet — Deep Dive into Pros, Cons, and Pitfalls

What Is JWT?

JWT (JSON Web Token) is an open standard for compact, self-contained information transfer. A typical JWT consists of three Base64Url-encoded parts separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header : declares token type and signing algorithm

Payload : carries actual data (user ID, roles, permissions)

Signature : verifies token integrity

Claimed Advantages — And the Reality Check

1. Stateless

JWT contains all authentication info, eliminating server-side storage and improving scalability. However, this statelessness is also its biggest flaw: once issued, a JWT cannot be revoked before expiry. Even if a user logs out, changes password, gets banned, or has roles modified, the token remains valid unless the backend adds extra validation logic.

2. CSRF Prevention

CSRF attacks rely on cookies automatically sent with requests. The article illustrates with a bank transfer example: a malicious link

<a src="http://www.mybank.com/Transfer?bankId=11&money=10000">

or an image tag

<img src="http://www.mybank.com/Transfer?bankId=11&money=10000" />

triggers an unwanted action when the victim visits a page. JWT stored in localStorage (not cookies) avoids this because the browser won't attach it automatically. But if JWT is placed in a cookie, CSRF risk returns. The key is keeping tokens out of cookies, not JWT itself.

3. Mobile-Friendly

JWT works across iOS, Android, and Web without cookie dependencies. The article notes this is true for any token mechanism, not uniquely JWT.

4. SSO-Friendly

Unlike Session, JWT stored client-side avoids cross-domain cookie issues and centralized session stores.

Common Problems & Solutions

1. Token Revocation (Logout, Password Change, Role Change, Ban, Force Logout)

These problems exist only with JWT; Session and traditional tokens handle them natively via server-side storage.

Solution A: Centralized JWT Storage (e.g., Redis)

Store valid JWTs in Redis; delete to revoke. Drawback: loses stateless advantage because every request must check Redis.

Solution B: Blacklist in Redis

Add revoked JWTs to a blacklist; check on each request. Drawback: only solves logout; cannot handle admin-initiated bans or role changes because the server doesn't know which JWTs belong to the affected user.

Conclusion: Both solutions violate JWT's stateless principle, making the advantage "illusory" in revocation-heavy scenarios.

2. Token Refresh / Renewal

JWT expiry is fixed; unlike Session (sliding window: 30 min inactivity extends another 30 min), JWT cannot dynamically extend without re-issuance.

Four Approaches:

Pre-emptive refresh near expiry: Server returns new JWT when old one is about to expire. Fails if user is active early but idle near expiry.

New JWT on every request: High overhead, especially with server-side storage.

Set expiry to nighttime: Compromise for B2B systems used only daytime.

Dual-token (access + refresh): Short-lived access_jwt (e.g., 30 min) + long-lived refresh_jwt (e.g., 1 day, single-use). Client uses refresh token to obtain new access token. Drawbacks: requires client cooperation; both tokens must be invalidated on logout; used refresh tokens need blacklist to prevent replay; brief gap during refresh (mitigated by client-side timer).

3. JWT Size Overhead

Header, Payload, Signature + Base64Url encoding make JWT larger than Session IDs or simple tokens, increasing network payload.

Mitigations:

Minimize payload to essential claims only

Compress with GZIP before transmission

Consider traditional tokens when payload is large

When to Use JWT (and When Not To)

Suitable Scenarios

Short-lived APIs (15–30 min)

Internal microservice authentication

Stable permissions, infrequent changes

Read-heavy, write-light systems wanting fewer DB lookups

Examples: content-reading platforms, internal tools, IoT device communication.

Unsuitable Scenarios

Systems needing instant permission revocation

Tokens carrying large data

High-security requirements (financial transactions)

Examples: e-commerce admin panels (frequent role changes), financial trading platforms.

The article concludes: JWT is not a silver bullet. Choose based on business context, not hype.