competition-oauth-oidc-chain

1# Competition OAuth OIDC Chain
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the hard part is proving how an OAuth or OIDC flow is shaped, exchanged, and ultimately accepted.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Map the auth chain in order: entry route, redirect, authorize request, callback, token exchange, refresh, and final accepting service.
122. Record scopes, state, nonce, PKCE material, redirect URIs, and claim-bearing tokens before mutating anything.
133. Separate token possession from actual identity acceptance.
144. Keep browser-visible redirects and backend-visible token exchange in one compact chain.
155. Reproduce the smallest redirect-to-acceptance flow that proves the decisive identity edge.
16 
17## Workflow
18 
19### 1. Map The Redirect And Token Path
20 
21- Record issuer, client ID, redirect URI, authorize parameters, callback parameters, token endpoint, and refresh path.
22- Note which values are user-controlled, derived, cached, or validated: `state`, `nonce`, PKCE verifier, audience, scope, or prompt.
23- Keep browser redirects, server-side exchanges, and resulting session state tied together.
24 
25### 2. Prove Token-To-Identity Acceptance
26…