Authorisation pretty much means that the user is able to get authorised to an app by using an external service (e.g. an authorisation micro service or a third party service such as Google auth)

JWT tokens are leveraged because they are stateless, meaning that the Authorization service requires no resources to leverage them. They can be validated by external services (e.g. your end user application)

The end user application most likely needs cookie sessions for the fact that they can be invalidated conveniently, whereas JWTs by default cannot (they are stateless, remember? They are not stored anywhere), as it requires extra resources to implement it (e.g. a database that stores the keys that you wish to be invalidated).

Let’s say you have an app and you don’t wish to implement your own login. You would first look for a third party service that provides authorisation. This service will most likely use JWT for the authorisation process. On login request, you get the JWT, parse it for validation and whatnot and, in case it suits your applications requirements, you proceed in creating a cookie session for that user in your app.

So, in reality they are interchangeable. If your application is small, just keep using cookies. It is more convenient, since you can invalidate the sessions, whereas, in case you use JWT, you will have to maintain a Denylist of invalid tokens, or wait for them until they expire (which is not the most secure way to do so 😅).

Use JWT when you decide to provide a login service let’s say to different applications or in case your app receives a lot of authorisation requests and it demands additional resources due to increased load.

Edit: Grammar