FrontendHaltSecurity·Intermediate·Conceptual·1 min read
What is the risk of validating a JWT without checking its signature and expiry?
Short interview answer
A forged or expired token would be treated as valid, letting an attacker impersonate any user by crafting an arbitrary payload; every verification must check signature validity and expiry, not just decode the payload.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.