OWASP [0] is a good resource for most things Web Security related

[0]: https://www.owasp.org/index.php/JSON_Web_Token_(JWT)_Cheat_S...