I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and payload.
I am not very familiar the details of OpenID, but I know that OpenID uses JWT as data format to pass the token.
My question is:
In OpenID (e.g. OpenID 1.0, 2.0, OpenID connect), is JWT further secured by applying additional encryption or other approach, to prevent token stolen or information leakage (I believe the answer should be yes)? And how?