competition-oauth-oidc-chain

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Use this skill only as a downstream specialization after

$ctf-sandbox-orchestrator

is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to

$ctf-sandbox-orchestrator

first.

Use this skill when the hard part is proving how an OAuth or OIDC flow is shaped, exchanged, and ultimately accepted.

Reply in Simplified Chinese unless the user explicitly requests English.

仅当

$ctf-sandbox-orchestrator

已激活并完成沙箱假设、节点归属确定和证据优先级设置后，才可以作为下游专项skill使用本工具。如果还未满足上述前置条件，请先返回

$ctf-sandbox-orchestrator

执行。

当核心问题是验证OAuth或OIDC流程的结构、交换过程以及最终被认可的逻辑时使用本skill。

除非用户明确要求英文回复，否则请使用简体中文回复。

Map the auth chain in order: entry route, redirect, authorize request, callback, token exchange, refresh, and final accepting service.
Record scopes, state, nonce, PKCE material, redirect URIs, and claim-bearing tokens before mutating anything.
Separate token possession from actual identity acceptance.
Keep browser-visible redirects and backend-visible token exchange in one compact chain.
Reproduce the smallest redirect-to-acceptance flow that proves the decisive identity edge.

Record issuer, client ID, redirect URI, authorize parameters, callback parameters, token endpoint, and refresh path.
Note which values are user-controlled, derived, cached, or validated:
```
state
```
,
```
nonce
```
, PKCE verifier, audience, scope, or prompt.
Keep browser redirects, server-side exchanges, and resulting session state tied together.

Show how code, ID token, access token, or refresh token turns into app session, claims mapping, tenant selection, or accepted privilege.
Record token claims, expiration, audience, subject, scopes, and the exact accepting app or backend edge.
Distinguish UI login success from backend authorization success.

Compress the result to the smallest sequence: entry request -> redirect -> callback -> token or claim acceptance -> resulting capability.
Keep one canonical good flow and one minimal mutated flow if a parameter change matters.
If the task broadens into generic web routing or storage behavior outside the auth chain, switch back to the broader web-runtime skill.

Load
```
references/oauth-oidc-chain.md
```
for the redirect checklist, token checklist, and evidence packaging.
If the hard part is JWT header parsing, claim normalization, key lookup, or token validation confusion after issuance, prefer
```
$competition-jwt-claim-confusion
```
.

加载
```
references/oauth-oidc-chain.md
```
查看重定向检查清单、令牌检查清单和证据打包规范。
如果核心问题是JWT头部解析、claim标准化、密钥查询或令牌颁发后的验证混淆问题，请优先使用
```
$competition-jwt-claim-confusion
```
。

Redirect URIs, parameters, codes, token claims, scopes, and the accepting service or callback
The exact point where claims or tokens become accepted app identity
One minimal replayable redirect-to-acceptance sequence