GUIDE深度 · Deep dive
JWT Security Notes
Decoding is only debugging. Servers must verify signature, algorithm, iss/aud/exp; do not treat the token as the only session state, and do not keep long-lived tokens in localStorage without expiry.
Server checks
Pin the algorithm; reject alg=none and algorithm confusion.
Verify iss/aud/exp/nbf and signature.
Client
Prefer HttpOnly+Secure cookies; localStorage is readable by XSS.
Short expiry plus refresh/revocation.
FAQ
Can JWTs be revoked?
Stateless JWTs cannot be revoked alone; use a denylist, short expiry or token version.
Can the payload hold secrets?
No; it is encoded, not encrypted.