JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying
Anyone holding a token reads its payload. Which fields therefore have no business being in there, why exp is the only thing that ends a token, and where decoding gets confused with verifying.








