JWTs carry a signature and a lifetime
A signed JWT carries claims whose integrity can be checked without looking up the entire token in a session table. That convenience does not make its contents confidential, establish authorization, or prevent replay. Start with the token format and the application’s validation contract, then test each boundary independently. A successful cryptographic check is one input to an access decision, not the decision itself. ...