Show HN: PAST, a secure alternative to JWT
I really don't get the whole "the spec supports choosing of algorithm, therefore the whole implementation is bad"<p>If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks?<p>Why do we need a whole new implementation?