> Also cookies are not cryptographically signed and thus easily forgeable by the client/browser While it's true that you could avoid signing cookies, this isn'

> Also cookies are not cryptographically signed and thus easily forgeable by the client/browser While it's true that you could avoid signing cookies, this isn't the default for any server library I'm aware of. If your library doesn't require a secret to use for signing, you should report it. I'm also unaware of JWT libraries that default to "none" for the algorithm (some go against the spec and avoid it entirely), though it's possible to use JWTs insecurely.