How to keep the shared secret secret when using JWT, for example?
<p>There is something very basic I do not understand. In order for JWT to be secure both the client and the server must share a secret.</p>

<p>However, the client is typically a JavaScript application running in a browser on some remote completely unknown client machine.</p>

<p>Suppose I am the author of both the server and the client code, how am I supposed to ensure the safety of the shared secret on the client side?</p>