Timezone Bug in Django Middleware Caused Endless Auth0 Login Loop

A developer discovered that a login loop in their application was caused by a subtle timezone mismatch in a custom JWT validation middleware, not a broken authentication flow. The Django backend was comparing token expiry timestamps — which are issued in UTC by Auth0 — against the server's local time, which was set several hours ahead of UTC. This made every newly issued token appear already expired, triggering an immediate 401 Unauthorized response on each API call. The frontend's session interceptor would then redirect the user back to Auth0, which silently issued a fresh token, restarting the cycle indefinitely. The fix required just one line change — replacing datetime.now() with datetime.now(timezone.utc) — to ensure the expiry comparison used the correct timezone.