JWT security checklist

• Reject alg=none and unexpected algorithms; only allow the algorithm you expect.
• The payload is not encrypted, so never put passwords, personal data or other secrets in it.
• Keep the lifetime short with exp, and control the validity window and reuse with nbf and jti.
• When verifying the signature, also check that iss and aud match your expected values.
• Secrets must be long and random, and must never be exposed to the client.

Related