If you have a secret in the JWT you definitely want to encrypt it (JWE instead of JWS). But yes, it's true. A signature will protect against manipulation thoug

If you have a secret in the JWT you definitely want to encrypt it (JWE instead of JWS). But yes, it's true. A signature will protect against manipulation though, like the article points out, which is enough for a lot of applications.