JWTs are frequently stored in LocalStorage which means that any XSS is able to leak the JWT.

Cookies, on the other hand, can be configured to be HTTP-Only and inaccessible to JavaScript on the page. That prevents somebody with XSS from leaking the value without a second server-side vulnerability or weakness.

In addition, JWTs are impossible to revoke without revoking _all_ sessions. This is the biggest weakness, imo, and the reason that they shouldn't be used client-side.

I'm a huge fan of the approach the Ory is taking with Oathkeeper and Kratos: https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-i...

Can't you revoke them the same way you revoke any other auth token and put the token ID in a database somewhere?

it won't be stateless then, and you might as well just use traditional sessions then

Sure, but browsers have done a lot of work to make cookies far more convenient (they're automatically sent with requests, you have browser APIs to work with them), and secure (Secure, HttpOnly, SameSite, etc.)

Cookies are a storage and transport mechanism and JWTs are signed JSON blobs. You could put a JWT inside a cookie.