[waoush]

It is JWT introspection. Apache modules have to be written in C, and therefore so does my parser. It's another piece of infrastructure.

Whether or not it makes sense to do it like that is another story, but I don't have control over the design of enterprise architecture.

[Mandatum]

Remember that Apache Remote Code Execution bug? No, not Struts, the other one. No, not mod_cgi, the other one. No, not auth_digest the other one.. ad inifinum. These were all caused by so-called "unsafe legacy functions". Just because YOU might not implement them, doesn't mean others won't.