[sjaak]

To make things easy I usually use "alg":"none". It makes using jwts a breeze.

https://datatracker.ietf.org/doc/html/rfc7518#section-3.6

[commandlinefan]

I recently discovered the TLS_NULL_WITH_NULL_NULL SSL ciphersuite (https://datatracker.ietf.org/doc/rfc5246/) - it makes analyzing network traffic so much simpler, and you don't even have to deal with certificates any more!

[mooreds]

Like a sibling comment said, hopefully this was tongue in cheek.

If you use "none", anyone can forge a JWT that says anything. I always say:

* You should have some other way of verifying that the JWT was unchanged by the client, like say being on a private network or using client TLS certs

and

* You should benchmark and know that the signing overhead is a significant source of performance degradation in your system.

Otherwise, sign your JWTs! :)

[jaywalk]

I hope this is a joke.

[sjaak]

It was, but judging by the downvotes my delivery was off :)