JWT isn't necessarily a complete solution as it lacks revocation. That can be handled in other ways, but some people insist on discouraging it rather than telling you how to properly handle them.