> So, not only do you have to ensure that your use of JWTs is sane You're the one using JWT. You can't blame the tech if you screw up how you apply it. > you

> So, not only do you have to ensure that your use of JWTs is sane You're the one using JWT. You can't blame the tech if you screw up how you apply it. > you have to ensure that the library you're using is doing sane things Isn't this concern observed in 100% of cases where a third-party lib is used? > The right thing to do should be the easy thing to do. There's little "easy" about the "proper" use of JWT. That is not true at all. It's quite simple: either you know what you are doing or you develop broken software with security problems. If you decide to adopt a security technique and then fail to learn the very basics then the tech is not to blame for the problems you create for yourself.