having worked with JWT token in places where it is used for monetary transactions, I have been witnessing a creepy discrepancy between the required level of kno

having worked with JWT token in places where it is used for monetary transactions, I have been witnessing a creepy discrepancy between the required level of knowledge to use them and the actual level of developers. In one place, I was sacked for saying too loud that JWT are base64URL encoded and not base64 encoded. The JWT token being passed in get, it made the auth system fail 40% of the time. And nobody understood the bug... I sent the bug report internally to the security department, and they saw nothing wrong. I discussed with a lot of other coders, they saw nothing wrong. My experience is JWT token are too complex to use. An authenticated session HAS to be statefull, the web is stateless. That's the point. PS it looks a lot like a logjam attack