A practical walkthrough of three JWT forgery attacks involving unsigned tokens, weak secrets, and algorithm confusion.