title: Using JWT instead of Cookie on SSL enabled site
body: <p>Instead of using a cookie I'm using a JWT token which gets send with every request. Every request is a POST request so that the token does not get saved in the browser's history.</p>
  
  <p>It's a single-page app.</p>
  
  <p>The token looks like:</p>
  
  <pre><code>{
      userId: 12345678,
      expires: &lt;UNIX timestamp&gt;,
      otherInfo: &lt;something&gt;
  }
  </code></pre>
  
  <p>Everything is SSL secured.
  The token is created on the server when the user logs on.</p>
  
  <p>Would this be a good way to replace a cookie or do you see any flaws?</p>