Overview
A compact lab about reading the verification path before reaching for a payload.
Code
const verified = verify(token, publicKey, { algorithms: ["RS256"] });The useful clue was the branch that selected the verification key.
Investigation
Takeaways
Pin allowed algorithms and test rejection paths as well as valid tokens.