api-auth-and-jwt-abuse

1# SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits
2 
3> **AI LOAD INSTRUCTION**: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.
4 
5## 1. TOKEN TRIAGE
6 
7Inspect:
8 
9- `alg`, `kid`, `jku`, `x5u`
10- role, org, tenant, scope, or privilege claims
11- issuer and audience mismatches
12- reuse of mobile and web tokens across products
13 
14## 2. QUICK ATTACK PICKS
15 
16| Pattern | First Test |
17|---|---|
18| `alg:none` acceptance | unsigned token with trailing dot |
19| RS256 confusion | switch to HS256 using public key as secret |
20| `kid` lookup trust | path traversal or injection in `kid` |
21| remote key fetch trust | attacker-controlled `jku` or `x5u` |
22| weak secret | offline crack with targeted wordlists |
23 
24## 3. HIDDEN FIELDS AND BATCH ABUSE
25 
26### Mass assignment field picks
27 
28```text
29role
30isAdmin
31admin
32verified
33plan
34tier
35permissions
36org
37owner
38```
39 
40### Rate limit and batch abuse picks
41 
42```text
43X-Forwarded-For: 1.2.3.4
44X-Real-IP: 5.6.7.8
45Forwarded: for=9.9.9.9
46```
47 
48GraphQL or JSON batch abuse candidates:
49 
50- arrays of login mutations
51- bulk object fetches with varying IDs
52- repeated password reset or verification calls in one request
53 
54## 4. RATE LIMIT BYPASS FAMILIES
55 
56```text
57X-Forwarded-For
58X-Real-IP
59Forwarded
60User-Agent rotation
61Path case / slash variants
62```
63 
64## 5. NEXT ROUTING
65…