It's like C. The language is fine, it just allows you to do bad things too easily. The same is true with JWTs. The idea is fine, but allows you to do bad things

It's like C. The language is fine, it just allows you to do bad things too easily. The same is true with JWTs. The idea is fine, but allows you to do bad things too easily. The no signature bit was a huge flaw in almost all JWT libraries across languages a few years ago. There are better schemes out there.