Formally proving that you can't be authenticated to a service without actually holding some type of authentication token is trivial.<p>Whatever you replace it with (a short-lived access token, a session cookie, a JWT, or whatever else) becomes <i>the</i> authentication token — if you add other properties (like short expiry), you are mostly trading convenience for security (eg. people will get logged out, or you'll need to implement refresh token dance in your app).<p>So it's really confusing to me how can someone pretend that there is something you can do on the unsafe client side, because you really can't (sure, there are obvious things you shouldn't do, like keep a plain text password in a cookie or localStorage, but an auth token is pretty much the same thing other than expiry).