One bug: this verifier checks the signature but never checks exp. Below is a genuine admin session token that expired an hour ago (you cannot forge one — the key is strong). Present it to /naked/no-exp/admin and watch it authenticate anyway.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbmlzdHJhdG9yIiwidWlkIjoxLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE3OTI1MzgyMTd9.-Q47muwAy39vsLVbpKQaAjzBeF6qaEsstcWCwwIeuyU
Present it as the pp_noexp cookie, or as ?token=<jwt>.
More hands-on practice → labs.hackxpert.com