Lab: the unsigned admin
A verifier that trusts the header. Decode, tamper, strip.
Read the issued token by decoding it: algorithm and subject in the clear. Tamper the payload to admin and watch verification reject the stale signature — the check works. Then strip the signature entirely with alg none: a verifier that honors the header will wave through a token nobody signed.
The tamper and strip helpers print full tokens; verify accepts a leading prefix, so you never retype base64 by hand.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.