General JWT approach that usually isn't terrible checklist

checklist.txt

☐ Put JWT in a cookie
☐ HTTPOnly cookie
☐ Secure cookie
☐ Domain w/ a subdomain (never root)
☐ No authorization in the JWT body (look it up serverside ya lazy asses)
☐ Userid in cookie should NOT exist anywhere but auth service
☐ Short window ( < 15 min) for JWT authentication token
☐ Ability to deauthorize a refresh token chain serverside (but long life on a refresh token is OK)
☐ Ability to monitor requests by refresh token chain

Bonus points for autogenerating the user ID when creating the JWT!