JWT Auth in .NET 8: The Validation Settings People Skip

There is a category of security bug that produces no error, no log entry, and no failing test. A token that should have been rejected gets a 200 instead, and the only way anyone finds out is by readin...