I’m not saying JWT is inherently insecure, but if this library is doing the default “encryption …

Chris Shaffer is a Nodejs enthusiast, JavaScript lover and Linux admin. His favorite JS library is vanilla JS and favorite Linux distro is Debian.

Aug 25, 2016

Perhaps, Christopher Shaffer, but I’m going to give them a try.

Paul Rene Nichols

I’m not saying JWT is inherently insecure, but if this library is doing the default “encryption “ that JWT is spec’d for, then it is insecure.

Either way, this library is only encoding to base64, which when sent from an unencrypted (not-SSL) site WILL be easily be decrypted. Base64 isn’t encryption.

I would use with the knowledge that this isn’t secure.