> No one is forcing you to accept/implement ALL possible aspects of JWT.. in fact, that's generally a bad idea... I think this is a very interesting, because i

> No one is forcing you to accept/implement ALL possible aspects of JWT.. in fact, that's generally a bad idea... I think this is a very interesting, because it's basically validating the article's argument. People are going to feel safe implementing JWT because it's an RFC, without knowing where these "generally bad idea" landmines are. That's the dangerous part. And yes, the same issues exist in SSL / TLS. And guess what? There's loads of articles just like this one stating how dangerous older modes of these protocols are. Articles like this and the discussions they spawn are exactly the kind of thing necessary to move the world forward into safer implementations.