The article and associated links are weak on details - most of them are some form of setting the alg incorrectly. > First, it’s a complicated standard Actuall

The article and associated links are weak on details - most of them are some form of setting the alg incorrectly. > First, it’s a complicated standard Actually it's remarkably simple and very well thought out; I frequently generate them in plain bash for testing. It is the simplicity that makes me trust JWT (where appropriate). > If they’re (Auth0) not safe, what chance does the general (developer) public have? Auth0 forgot to check latter case in alg = 'none', a very basic coding error. These errors can happen anywhere, and anyway use a whitelist for algorithms. The other links are quite similar, such as using a weak alg. > A last issue with JWT is that they are relatively big, and when used in cookies it adds a lot of per-request overhead. Most apps simply put userid and roles in the JWT, and that's negligible overhead. Of course there are people who do it wrong, but there are also people who store 10MB of data in a session. My view is that JWT has a place in the future, and it works well even with decentralized systems. The ecosystem around JWT is rich, and over the years has evolved to solve many common usecases which come up in production. An example would be the JWK/JWKS spec, which greatly simplify how verification keys can be fetched.