"most applications should store it in a cookie"
Why do you think that most application should store JWT token in the cookie? Both approaches have their pros/cons.
Why do you think that most application should store JWT token in the cookie? Both approaches have their pros/cons.
This does a better job that I'm going to try for in a HN comment: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...