If you are going to use JWT besides its failings, you should use it safely. But not all advice in this piece is equally strong. 1. RS256 vs ES256 - you shouldn't use either. RS256 not just an old standard on the way out. With safe keys sizes tokens are often going to be too large and signing too slow for you. ES256 on the other hand, suffers from many theoretical flaws and at least one practical flaw that (complete b…
Security is always relative. There usually is a "don't use JWTs" alternative, but it's almost always shared secrets. Passwords, cookies, or some variation on that concept. In that light, even poor jwt hygiene is better than none as long as you avoid a few key mistakes. But on the other hand, security is, at it's core, the assessment of what guarantees a given technology can actually provide versus what you _depend_ o…
JWT is just a badly designed standard which like many other badly designed standards (XMLDsig, older versions of TLS) can be used safely if you choose the safest subset you can and tread with care.
But there are faster, simpler and more secure replacement for JWT nowadays like PASETO. If you can, you should use them.