The problems with JWT are not related to MITM, XSS or CSRF vulnerabilities. You'll have to address these issues regardless of the type of token you're using.
The problems with JWT can be divided into two classes:
1. Too many options, making it easy to misuse.
Even if you disallow the 'none' algorithm (like most newer
JWT libraries), there are still many other ways to break
it. e.g.:
https://auth0.com/blog/critical-vulnerabilities-in-json-web-...
The problems with JWT can be divided into two classes: 1. Too many options, making it easy to misuse. Even if you disallow the 'none' algorithm (like most newer JWT libraries), there are still many other ways to break it. e.g.: https://auth0.com/blog/critical-vulnerabilities-in-json-web-...
2. Misguided cipher choice. AES-GCM (easy target for nonce-reuse), RSA, NIST P-curves.
So in short, even if you're using encryption, JWT just makes it easy for the crypto itself to fail.