What is a common mistake when working with JWT authentication?

A common mistake with JWT authentication is decoding a JWT without cryptographic and claim validation allows attackers to present arbitrary claims that look structurally valid. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.