A JWT is sent in the Authorization header. An attacker intercepts it and inspects the payload. What data is visible?

• A.The payload is hidden since JWTs are encrypted with the signing key, so an interceptor sees only ciphertext unless the server's HMAC secret (HS256) is known to the attacker
• B.All claims in the payload (user ID, roles, email, expiry, etc.) are visible since the payload is only Base64url-encoded, not encrypted, unless a JWE (JSON Web Encryption) token is used
• C.Only the header is visible because the payload is compressed with gzip (a format all proxies decode), but the roles are removed before the token is sent to the client
• D.No claims are visible since the signature covers the whole token (a hash of the payload), so a replayed token never reveals the payload to an interceptor on the network