The JWT function everyone mistakes for a security check

Let me hand you a valid-looking token and an app that trusts it. // The endpoint that decides who you are on every request. function currentUser(req) { const claims = jwt.decode(req.headers.authoriz