FIFA

The gist's core claim: JWTs were built for ~5-minute tokens, not logins, and 'they are not designed for this purpose, they are not secure.' Use session cookies, or PASETO for signed tokens.

The recurring qualifier from the thread: that's true for browser sessions, and basically only browser sessions.

The flip: one commenter dared anyone to break AWS STS's AssumeRoleWithWebIdentity if JWTs are really that insecure. No takers.

The flaw was textbook: roles were checked client-side only. The server never validated the JWT, so the APIs served live broadcast infrastructure to anyone who registered on FIFA's public Agent Platform. Push to the RTMP endpoint and you replace the feed on TV worldwide.

The twist: FIFA never responded. No acknowledgment, no thank-you, no bounty — they just silently patched it. Half the thread asked why he reported it at all.