What I meant was don't put identifiable user information (ids, email addresses, etc.) on the client in a JWT or cookie and use that as a session identifier. If the JWT or cookie gets hacked then someone can impersonate anyone on your system.
Putting their info (email, name, etc.) on a user profile type of page should be fine if your app has a need to do that.
Yes.
> JWT/cookie page rendered stuff is fine
Please could you elaborate on this?
> And use HTTPS for all traffic.
Yes, that is done.
> unless this is a comp-sci quiz question testing your understanding of sessions/security, haha
No it is not :)