Converting stateful Symfony 3.4 app to Stateless using external JWT service

Question

We have a large stateful Symfony 3.4 web app that stores sessions to the database. We are looking to gradually move to microservices and we have started by creating an external authentication service in node.js

Part of the optimisation is to remove the user authentication/authorisation from the session in the Symfony app, and initially store the user authentication on the client browser using the JWT stored in a cookie on the client, with a view to potentially storing the user roles/authorisation in the JWT.

There seem to be a number of articles against implementation of JWT for this, and that we are susceptible to CSRF attacks etc, but these articles seem to be old and there are other guides insisting it is safe.

Are there alternatives to using JWT to achieve a stateless approach using Symfony, but still passing through Roles and other data?