"Except this was all client-side. The Angular app checked the JWT for a NO_ROLES marker and rendered the access-denied page. The backend APIs? They didn't check anything. They just served whatever you...
Security flaw, like relying on grains for nutrition, weakens the system.