> The way JWT solves CSRF is not by the way it's stored; it's by the way it's transmitted in an Authorization header, which can't be done cross-domain and won't

> The way JWT solves CSRF is not by the way it's stored; it's by the way it's transmitted in an Authorization header, which can't be done cross-domain and won't be included by the browser (as cookies would). If you're not using JS, you shouldn't be looking at JWT at all; it's useless without it. This isn't quite true: JWTs may also be transmitted as an access_token URL or form parameter. As such, they are not useless without JavaScript (which is good). > > JWT tokens are not exactly small. > They're as small as a secure cookie: metadata header + data + signature. That's it. They're in a sadly verbose format, which by its nature tends to lead to double-Base64-encoding values. There're a lot of double-quotes and commas, which isn't wonderful. It's not a colossally-wrong format like XML, but it's not great. And it's not terribly readable, despite being somewhat verbose.