Example is insecure by default about sapper-authentication-demo

[sylvain-reynaud]

The token isn't verified on backend in his code.
I guess you should use jwt.verify in the backend to avoid spreading the access token secret on 2 different servers. In this way using jwt.decode on the server-side is ok.

[antony]

Yes - as you've noticed this is a vastly simplified example. I'm not here to teach JWT best practices, we could go into all sorts of detail about how to verify authenticity, expire, renew, etc!

It's important to keep things as simple as possible so that the code is easy to understand. Decoding an entire JWT to set an authenticated boolean is also not particularly useful :)

If you're using JWT in your app - it's essential to understand what a JWT is and how it works, but that's out of scope for this example :)