Magic link

Magic link generated — note the full session JWT is embedded in the URL query string (it would be emailed in cleartext and logged by every proxy).

https://ratauth.lab/m07/account?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwidWlkIjoyLCJyb2xlIjoidXNlciIsImV4cCI6MTc4ODA3MjUxMH0.l93x3IdyQwHQ0vhcWeSWrEBX-7e62HFkE4-u_FJxR9I

Putting a bearer token in a URL leaks it via Referer headers, browser history, and access logs. A session token belongs in a cookie/Authorization header, never a link.