"On successful login two cookies will be created: jwt - A "JSON Web Token" (JWT) containing profile information and the respective access tokens (Twitter/e

"On successful login two cookies will be created: jwt - A "JSON Web Token" (JWT) containing profile information and the respective access tokens (Twitter/etc). http-only! profile - A JSON string which containing non-sensitive information (accessible from browser JS): username - string / mandatory, the account specific user alias (e.g. Twitter name) - photo - string / optional, the account specific user image link name - string / optional, the "real" name " This looks like just enough rope to hang oneself. If you check only the profile variable it could easily be set by the user herself. So I guess you need to check the jwt. I guess it makes more sense if this would be run as reverse proxy so the cookies can't be tampered with.