competition-jwt-claim-confusion

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Use this skill only as a downstream specialization after

$ctf-sandbox-orchestrator

is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to

$ctf-sandbox-orchestrator

first.

Use this skill when the decisive bug is not just "there is a JWT," but how headers, claims, and key selection turn into accepted identity.

Reply in Simplified Chinese unless the user explicitly requests English.

仅当

$ctf-sandbox-orchestrator

已处于激活状态，且已完成沙箱假设、节点所有权和证据优先级的设定后，才可作为下游专项技能使用。如果尚未满足上述条件，请先回到

$ctf-sandbox-orchestrator

流程。

当核心漏洞不只是「存在JWT」，而是涉及头部、声明和密钥选择如何转化为被接纳的身份时，使用本技能。

除非用户明确要求使用英文，否则使用简体中文回复。

Split the token path into parse, key lookup, signature or decryption, claim validation, and final acceptance.
Record header fields, claims, key source, issuer, audience, and role mapping before mutating anything.
Separate possession of a token from the exact service that accepts it.
Keep parser behavior, trust policy, and resulting app session or privilege in one chain.
Reproduce the smallest token-to-acceptance flow that proves the decisive confusion.

Record header fields such as
```
alg
```
,
```
kid
```
,
```
typ
```
,
```
cty
```
,
```
jku
```
, or embedded key material when present.
Note where keys come from: static config, JWKS, local file, cache, or dynamic lookup.
Keep token parser, key selection path, and validation mode tied together.

Show how subject, audience, issuer, tenant, scope, role, or custom claims become app session, route access, or backend privilege.
Record expiration, not-before, clock skew, issuer matching, audience matching, and claim normalization behavior.
Distinguish token parse success from actual authorization success.

Compress the result to the smallest sequence: token supplied -> parser or key path taken -> claim accepted -> resulting capability.
Keep one canonical accepted token path and one mutated token path if confusion or bypass depends on a delta.
If the task broadens into a larger OAuth redirect chain, hand back to the tighter OAuth skill.

Load
```
references/jwt-claim-confusion.md
```
for the header checklist, claim checklist, and evidence packaging.

Raw headers, claims, key source, JWKS or local key path, and the accepting service
The exact validation or normalization step that turns the token into accepted identity
One minimal replayable token-to-acceptance sequence