For our REST API architecture, we are currently thinking over two options -
Json Web Token - pros are that it is industry standard, we pass a key which adds a layer of access control and using which we can also add secondary authorisation restrictions at our backend, maintenance of session and related security features are provided by Django by default.
Cons are that the params are open for anyone to see, it seems (and correct me if I'm mistaken) that it is possible that if someone gets access to our link, he could alter a param that is not linked with the core authentication process and thus compromise the data.
An in house encryption process we developed that encrypts all the params. Pros are that we are fairly certain of it to have never been compromised, for even if the link would have gotten into the hands of someone they wouldn't have known how to decrypt it to look at the params.
Cons are that we have to manage all the session data through our backend code in our tables, so we aren't able to utilize the Django features. Also, the idea that what we are doing isn't industry standard.
What is the right way to decide in this situation, and what are the factors that we should take into account?