Hacker News Reader

Am catching up. Would these tokens be the signed JWT’s, if so am wondering how they were able to figure out the signature part?

I imagine you just "replay" the issued/signed JWT to Facebook, so you can act like that user.