How to Use JSON Web Tokens
JWTs are useful, but there are a few things that are not immediately obvious.<p>1) They are <i>signed</i> not encrypted. Anything you put in there is public readable, <i>unless you encrypt your token after you generate it</i><p>2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm)<p>I am surprised at how naive the JWT spec is. Why in this day an age is encryption a default for the _payload_? Also, why on earth is 'None' allowed as a signing algorithm? Thats just a cookie..