The lack of logout and XSS are problems, but I ran into a couple apps that completely forgot to expire sessions due to lacking framework support. In nodejs's cookie-session and @google-cloud/connect-firestore sessions never expire. This issue impacts downstream software including, awkwardly enough, Google's Passkey demo apps. There isn't interest in fixing this.
Make sure your app is actually using a JWT framework, not a lesser version, and implements basic security practices.
Make sure your app is actually using a JWT framework, not a lesser version, and implements basic security practices.
[1] https://github.com/expressjs/cookie-session
[2] https://github.com/googleapis/nodejs-firestore-session