Discussion on: JWT Authentication Best Practices

[Vasilis Plavos]

Thanks for the article. I have two questions about JWT:

1. What if somebody steal a not-expired token?
2. What can we do when the token expired? The user has to login with username and password?

[Denis]

1. He could use it to get secret data
2. Yes