Is JWT an over-the-top myth?

In fact, in layman's terms, it is just a json format specification similar to the cookie scheme. And most of the options are optional, even if you don't follow this set of specifications, you can design a good solution. JWT is only responsible for the data not being tampered with, but it cannot guarantee that the data is not leaked. It should be captured and replayed. Talking about security, it is actually other solutions, but the benefits are blown to JWT. So don't be too superstitious about JWT, it's actually just cookie+hash (cookie).