JWT — the parts people get wrong

The most dangerous JWT is not an expired one; it’s not the tampered one either. It’s the valid, properly signed, not-yet-expired token that…