> The other big mistake I've seen is encoding personal data in the token, You’re right that this is a big mistake but I also thought this was in fact one of th

> The other big mistake I've seen is encoding personal data in the token, You’re right that this is a big mistake but I also thought this was in fact one of the primary allures of JWT - an attempt (misguided) to make session management stateless and avoid that database roundtrip on the server end?