عرض عملي: مهاجمة التحقق من الرموز (التلاعب والانتهاء والجمهور)

خطوة بخطوة

1. Change a claim (roles to ADMIN) without re-signing: the API returns 401.
2. Wait for or set an expired token: 401.
3. Issue a token with the wrong aud: 401.
4. Try an unsigned alg: none token: 401.
5. Planned mistake: a decoder configured without an audience check accepts the wrong-audience token. Fix: add an audience validator and re-run.
6. Turn each attack into an automated test.