Is there a way that someone could put malicious code inside a JWT and then it get executed?

[Aaron Gray]

First time JWT user here. I am planning on storing my JWT's client-side, in web storage or in a JS-readable cookie. Since both of these things can be edited by users, I was wondering if it was possible that an attacker could encode malicious code inside the JWT, and then it get executed when I run JWT.decode server-side?

Thanks for any insight into this!

[excpt]

Hi Aaron,

the content inside the token is not executed. The jwt gem decodes the token and returns a hash.

[aa...@ponderyourpath.com]

Very helpful, thanks for the insight!