I am using JWT for my projects to keep stateless sessions between servers and for some other
tokens (refresh, register, reset pass etc.). Of course extra security measures are required (MitM protection [HTTPS etc.], XSS / CSFR prevention etc.), but this has nothing to do with JWT. I use encryption with a frequently rotated private key to encrypt the part of the payload that only the server may read.
A good read at: https://stormpath.com/blog/where-to-store-your-jwts-cookies-...