DOM-based test cases — JWT client misuse

Tokens pulled from URL fragments or cookies and written to storage / outbound requests.

INLINE-1 (High): hash/cookie token → storage + fetch header

const token = location.hash || document.cookie;
localStorage.setItem('token', token);
fetch('/api', { headers: { Authorization: 'Bearer ' + token } });