How to Use JSON Web Tokens
JWTs are useful, but there are a few things that are not immediately obvious.1) They are signed not encrypted. Anything you put in there is public readable, unless you encrypt your token after you generate it2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm)I am surprised at how naive the JWT spec is. Why in this day an age is encryption a default for the _payload_? Also, why on earth is 'None' allowed as a signing algorithm? Thats just a cookie..