title: Why does the client need to decrypt JWE?
body: <p>If I'm using JWE to send an encrypted JSON message, which will be stored on the client-side, for use with authorization, why would the client need to decrypt this message?</p>
  
  <p>Client attaches the JWE token to all requests. Server identifies client using JWE token and responds or denies request. Throughout, only the server can decrypt.</p>
  
  <p>If there's no problem with this structure, what's the best way to implement it? Should I use asymmetric encryption and not provide a public key (is this possible within the JWE spec)?</p>
  
  <p>Along these lines, what's the best way to ensure the JWE token hasn't been intercepted and, though not decrypted, attached to a malicious server request, effectively allowing an attacker to impersonate the client?</p>
  
  <p>Also, are there any other security concerns I'm missing?</p>