It predates JWTs by several years. In practice is is used the same way is as symmetrically signed JWTs though by default with HMAC-SHA-1 vs HMAC-SHA256. It can

It predates JWTs by several years. In practice is is used the same way is as symmetrically signed JWTs though by default with HMAC-SHA-1 vs HMAC-SHA256. It can support a timestamp (`iat` for JWT) to implement expiry but not an actual `exp`; nor `aud` and the other common fields. It also dose not handle encryption or asymmetric signing. Whilst these all sound like drawbacks they do give it simplicity which is also a useful feature.