JWT best practices to be implemented

[godwinpinto]

Feature:
Currently JWT uses a symmetric key to encrypt and verifies all token generated from the application for authentication of REST API's.

Solution
https://owasp.org/www-chapter-belgium/assets/2021/2021-02-18/JWT-Security.pdf
https://curity.io/resources/learn/jwt-best-practices/

Alternative:
The headache of JWT can totally be removed with springs oauth2 implementation and Keycloak. However, running another application for SME would mean more cost involved. Hence, in application implementation