express-jwt

If I get a JWT and I can decode the payload, how is that secure? Couldn’t I just grab the token out of the header, decode and change the...