Building and Breaking My Own JWT Auth System — Part 1: Setting the Foundation

Part 1 of a series where I build a Flask API with JWT authentication, then deliberately exploit six real vulnerabilities in it — documenting why each one exists at the JWT specification level, not jus