Redis Goes Quiet

An API currently issues an opaque session cookie and looks the session id up in Redis on every request. The team replaces it with a signed JWT that the client sends in an Authorization header. What is the primary operational change?

Each request gets smaller on the wire, because a JWT encodes the same claims in fewer bytes than an opaque session id

Any API instance can accept the request by verifying the signature locally, so there is no session store read on the hot path

The claims become unreadable to the client, because the JWS signing step encrypts the payload under the same key that produces the signature

A single administrator action can still end one user's session instantly, because the authorization server records every token id it issues