On using JWT's for sessions (which I think most folks assume would be a primary use case) I found this: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-j

On using JWT's for sessions (which I think most folks assume would be a primary use case) I found this: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo... Also: it's very easy to abuse JWT tokens by storing them inappropriately... https://stackoverflow.com/a/27301616/19020 https://stackoverflow.com/a/27301616/19020