Additional Notes
Why not store secrets in the JWT payload?
Track: Java
Topic: Authentication
Focus: JSON Web Tokens (JWT)
Java: JSON Web Tokens (JWT)
Answer
Because the payload is readable claim data, not encrypted secure storage.
JWT payloads are base64-encoded, not hidden. Anyone holding the token can decode the claims, so passwords, card data, or other secrets do not belong there.
JWT payloads are base64-encoded, not hidden. Anyone holding the token can decode the claims, so passwords, card data, or other secrets do not belong there.
Topics: Authentication Java JSON Web Tokens (JWT)