That is why if you have these thee letters anywhere in your code AES then you are probably vulnerable. If you want to do it right you have few options:
- If there is no additional requirements - encrypt only on transport layer, like TLS, and call it a day
- Use good token implementations, like PASETO (JOSE (used by JWT) is plagued with problems)
- Use foolproof API from entrusted authors instead of building the protocol on your own
Doing crypto on your own is enormously hard.
