<li>Accepts JWT tokens (with <code>RequestAuthentication</code>)</li><li>Has some service paths without <code>AuthorizationPolicy</code> applied.</li></ul><p>For the service paths that both conditions are met, an incoming request with a JWT token, and the token issuer is not in
<code>RequestAuthentication</code> will bypass the JWT validation, instead of getting rejected.</p><h2 id=mitigation>Mitigation</h2><p>For proper JWT validation, you should always use the <code>AuthorizationPolicy</code> as documente