4 ms·

I did not know that. What would be the point of encrypting the JWT? Allowing the client to see the claim should not really be a concern.

• dathinab 6y ago
  You can put claims (and other metadata) in their which you don't want the client to see. Like you might not want to expose how exactly your internal permission system works to the client to make it harder to find places what did to bad configuration your JWT can be (ab)used to do thinks it shouldn't be able to. (I.e making security bugs harder to find from the outside). Or it could expose internal IDs which might have some privacy concerns. Or the internal IDs are not as security random and you might maybe be able to use that in some way to have a very round about kind of Oracle like attack. Or this internal data could be used to make social engineering attacks easier. .... Edit: or you encapsulate another internal only access token in there which the gateway server your website communicates with used to access the resources you are allowed to access and you want to make sure that a attacker who got access to the internal network somehow doesn't has access to any internal tokens without hijacking a service which has such tokens.