I wrote a blog post about the importance of adhering to security best practices when working with JSON Web Tokens. You can read it on Curity's blog: https://curity.io/blog/your-apis-are-only-as-secure-as-your-jwts/