JSON Web Token Security Issues

I don't know much about security or cryptography, but the people I read seem pretty well convinced that JWT is bad.

JSON Web Token

Wikipedia, in lieu of an explanation of what JSON Web Tokens are.

No Way, JOSE! Javascript Object Signing and Encryption is a Bad Standard That Everyone Should Avoid

The HN comments are also rather good. They include Thomas Ptacek saying that there are existing alternatives to JWT, they're just not well documented/standardized.

Things to Use Instead of JWT

An article covering use cases where you might use JWT, and suggesting alternatives for most but not all of them.

Thomas Ptacek's Comment on JSON Web Tokens

In cryptography, we have a concept of "misuse resistance". Misuse-resistant cryptography is designed to make implementation failures harder, in recognition of the fact that almost all cryptographic attacks, even the most sophisticated of them, are caused by implementation flaws and not fundamental breaks in crypto primitives....

So, as someone who does some work in crypto engineering, arguments about JWT being problematic only if implementations are "bungled" or developers are "incompetent" are sort of an obvious "tell" that the people behind those arguments aren't really crypto people. In crypto, this debate is over....

For almost every use I've seen in the real world, JWT is drastic overkill; often it's just an gussied-up means of expressing a trivial bearer token, the kind that could be expressed securely with virtually no risk of implementation flaws simply by hexifying 20 bytes of urandom. For the rare instances that actually benefit from public key cryptography, JWT makes a hard task even harder. I don't believe anyone is ever better off using JWT. Avoid it.