title: How to handle the JWT on the client layer?
body: <p>This is a subjective question, although I believe this is not opinion based. The only reason of asking it here is that I could not find satisfying answer even after reading multiple articles on JWT Authentication.</p>
  
  <p>I recently started learning JWT and found that it is a 3 part token issued by server to client for authenticity along with passing data like user-scope/roles/permission etc in forms of claims.</p>
  
  <p>My question however are:</p>
  
  <ol>
  <li><p>The claim part of token still is base64 encoded string which can easily be parsed using <code>atob/btoa</code>. So is the transmission really secure ? What is the real gain here ?</p></li>
  <li><p>There are multiple articles on generating and sending token to UI. However, almost no good articles on what UI does exactly with it. Is it a common practice to decode the token using <code>atob</code> and use the content within it ? Or is there a different way of validating and retrieving data from it.</p></li>
  <li><p>Is it really secure to transmit data via headers. I mean is it safe against things like MITM, XSS etc.</p></li>
  </ol>
  
  <p>I would really appreciate some efforts from the expert in resolving these queries ?</p>