Bad example. While the tokens themselves can only be secured in a handful of ways, JWT auth implementation is notoriously tricky. Even the official docs of some well known packages promote insecure practices such as storing tokens in browser localStorage.