Show HN: PAST, a secure alternative to JWT
I really don't get the whole "the spec supports choosing of algorithm, therefore the whole implementation is bad"If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks?Why do we need a whole new implementation?