Magic link

Magic link generated — note the full session JWT is embedded in the URL query string (it would be emailed in cleartext and logged by every proxy).

https://ratauth.lab/m07/account?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwidWlkIjoyLCJyb2xlIjoidXNlciIsImV4cCI6MTc5MjU0NzU1MX0.Qf8RyLnSo5W6G79zXtPst4GvqsPUgYCIkQXit3dSWk4

Putting a bearer token in a URL leaks it via Referer headers, browser history, and access logs. A session token belongs in a cookie/Authorization header, never a link.