DEV Community

Discussion on: Demystifying JWT: How to secure your next web app

Collapse
 
dbanty profile image
Dylan Anthony

Important to keep in mind that the payload is signed but not encrypted so don’t put anything in there you don’t want the user to see.

Also this token is (likely) going to be sent with every request so try to keep the size down.

Also also python-jose is a more general purpose JWT library you can use in Python.

Collapse
 
hansyes profile image
Anselmo Martín

Yes, I always say JWT is like a glass box, if is Broken it's invalid. But all can see inside.

Collapse
 
omawhite profile image
Omar White

This is a really good analogy thank you.