JWT 被批技术债：多数应用不需要
推荐指数 48.0 NO. 011 · 2026.05.24
发布2026/05/23Score63Comments47
为什么值得看
后端开发者发文痛批 JWT 是 cargo cult，认为它解决的是多数应用不存在的问题，却带来令牌撤销困难、刷新机制冗余等实际麻烦。作者基于多个 Laravel 项目经验，呼吁重新审视 session 方案。
编辑判断
这篇文章踩中了后端社区长期存在的认知分裂。支持 JWT 的一方通常强调微服务和跨域场景，但现实中大量单体应用跟风采用，结果用 Redis 做黑名单、用 refresh token 模拟 session，本质上是有状态却假装无状态。
值得注意的信号是 Laravel 生态的转向：官方 Sanctum 已经默认推荐 SPA 用 cookie-based session，JWT 包维护活跃度明显下降。如果你正在做新项目选型，除非明确需要第三方令牌分发或完全无共享存储的架构，否则从 session 开始、遇到瓶颈再迁移，比反过来拆 JWT 要省心得多。
评论区可能出现"但 OAuth 必须用 JWT"的反驳，注意区分协议层（OIDC 的 id_token）和应用层（自己的 API 鉴权），后者完全可以用 opaque token + introspection 解决。
社区反馈
意见分歧 45 条评论
核心争论：JWT 是跨域分布式场景的刚需，还是 session 就能解决的过度工程
Eh. JWTs are super handy if you have a single web experience spread across multiple backend apps on the same domain, with a single SSO server to set up the user auth. Definitely not for storing anything sensitive, but treating it like a fancy session cookie with the minimal amount one needs to secur
How that is possible, when every web framework has a package for handling sessions, and in a secure manner. Rolling everything on your own is time consuming and error prone. I know you should not use library for everything, but this is solved problem for a long long time (like crypto), and just usin
Yeah... but you can't just move a session across a heterogeneous set of servers with different backends, etc... Maybe some of your APIs are on one platform, the apps themselves on another. There are several libs that can help you do that.