We'd recently moved our jwt code into rust (using the jsonwebtoken crate), and it's wonderful to have this article to read in that context. The pitfalls listed

We'd recently moved our jwt code into rust (using the jsonwebtoken crate), and it's wonderful to have this article to read in that context. The pitfalls listed in the article were mostly handled by design, so we had to correct mistakes in the PHP implementation that were impossible to make now. Eg we'd been using the `iss` field, a claim, to determine which key to use, when we should've used the `kid` in the header. All claims are now completely inaccessible until verified to the point where there's no way to access them short of manually deserializing the jwt. We'd also allowed some invalid tokens where the `exp` was in the past, only if you were refreshing the token of an active session. This could've caused problems if we ever wanted to issue a token that expired very quickly, since you could have a token that's theoretically 10-times longer lived than you intended.