Is JWT enough for security?
Information exchange: JWTs are a good way of securely transmitting information between parties because they can be signed, which means you can be certain that the senders are who they say they are. Additionally, the structure of a JWT allows you to verify that the content hasn't been tampered with.The first and most important rule is to always use HTTPS for your web application. HTTPS encrypts the communication between the browser and the server, preventing anyone from intercepting or tampering with your JWT tokens.Problems with JWT

JWT is named pretty well, but fails miserably at the first problem: invalidation, or How do you log out the user The answer is, you don't. You can't. You (the server) can tell the user's client software to forget their JWT and hope they'll do it, but you can never be sure.

Is JWT obsolete : The JWT app type will be completely deprecated as of June 2023. New and current users have 12 months to migrate their JWT based solutions to the Server-to-Server OAuth app type. Action recommended: Create Server-to-Server OAuth app types to replace existing JWT app types.

Can you destroy a JWT token

JWT Tokens are stateless – meaning they don't get saved on the server in e.g. a session or the database. The easiest way for your application would be to just delete the JWT token on the client when the client makes the logout request.

What is the threat to JWT tokens : Lack of Encryption

This can be a significant concern, especially when JWTs are used to transmit sensitive user data, such as personal information or access tokens. Attackers who gain access to a JWT can easily decode its payload and extract sensitive information.

Because JWTs are frequently not encrypted, anyone who can execute a man-in-the-middle attack and sniff the JWT now has access to your authentication credentials. This is made easier because the MITM attack only has to be carried out on the server-client connection.

So why is JWT dangerous for user authentication The biggest problem with JWT is the token revoke problem. Since it continues to work until it expires, the server has no easy way to revoke it. Below are some use cases that'd make this dangerous.

Can JWT tokens be hacked

There is actually a pretty good reason for this wide adoption and that is, for the most part, security and resilience. However, just like any technology, JWT is not immune to hacking.Just because a JWT contains a cryptographic signature it doesn't automatically mean that it's safe, or that you should blindly trust the token. Unless good practices are observed your APIs can become vulnerable to cyber-attacks.A: JWT apps were deprecated on a rolling basis starting Sept 8, 2023. If your app was deprecated and you need more time, you can re-activate it and get a one-time extension until November 10, 2023. After November 10th, the app will be permanently removed and the credentials will be revoked.

Secure: Opaque tokens do not contain any user information, making them more secure than JWT tokens. Flexible: Opaque tokens can be customized to store additional user information in the authorization server, which can be retrieved by the resource server when needed.