{
 "product": "BROKER",
 "slug": "broker",
 "base": "https://cainstudio.online",
 "page": "https://cainstudio.online/top25-broker.html",
 "claims": [
  {
   "id": "C01",
   "kind": "control",
   "claim": "Mint and use once -> The exact request it was minted for works.",
   "requests": [
    {
     "method": "POST",
     "url": "/broker-keystone/mint",
     "body": {
      "agent": "support-agent",
      "method": "GET",
      "path": "/orders/1182",
      "body": ""
     }
    },
    {
     "method": "GET",
     "url": "/broker-keystone/demo-api/orders/1182",
     "headers": {
      "Authorization": "CAIN-Action ${0.token}"
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    200
   ]
  },
  {
   "id": "C02",
   "kind": "attack",
   "claim": "Use the same credential twice -> Single use: a replay is refused.",
   "requests": [
    {
     "method": "POST",
     "url": "/broker-keystone/mint",
     "body": {
      "agent": "support-agent",
      "method": "GET",
      "path": "/orders/1182",
      "body": ""
     }
    },
    {
     "method": "GET",
     "url": "/broker-keystone/demo-api/orders/1182",
     "headers": {
      "Authorization": "CAIN-Action ${0.token}"
     }
    },
    {
     "method": "GET",
     "url": "/broker-keystone/demo-api/orders/1182",
     "headers": {
      "Authorization": "CAIN-Action ${0.token}"
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    401,
    403
   ]
  },
  {
   "id": "C03",
   "kind": "attack",
   "claim": "Use it for another order -> Bound to one path.",
   "requests": [
    {
     "method": "POST",
     "url": "/broker-keystone/mint",
     "body": {
      "agent": "support-agent",
      "method": "GET",
      "path": "/orders/1182",
      "body": ""
     }
    },
    {
     "method": "GET",
     "url": "/broker-keystone/demo-api/orders/1183",
     "headers": {
      "Authorization": "CAIN-Action ${0.token}"
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    401,
    403
   ]
  },
  {
   "id": "C04",
   "kind": "attack",
   "claim": "Path traversal on the bound path -> Normalised before matching.",
   "requests": [
    {
     "method": "POST",
     "url": "/broker-keystone/mint",
     "body": {
      "agent": "support-agent",
      "method": "GET",
      "path": "/orders/1182",
      "body": ""
     }
    },
    {
     "method": "GET",
     "url": "/broker-keystone/demo-api/orders/1182/../../customers/7",
     "headers": {
      "Authorization": "CAIN-Action ${0.token}"
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    400,
    401,
    403,
    404
   ]
  },
  {
   "id": "C05",
   "kind": "attack",
   "claim": "Mint for a path the agent was never granted -> No grant, no credential.",
   "requests": [
    {
     "method": "POST",
     "url": "/broker-keystone/mint",
     "body": {
      "agent": "support-agent",
      "method": "DELETE",
      "path": "/invoices/INV-9",
      "body": ""
     }
    }
   ],
   "path": "decision",
   "expect": [
    "DENY"
   ]
  },
  {
   "id": "C06",
   "kind": "attack",
   "claim": "Attenuate to a wider path -> Attenuation can only narrow.",
   "requests": [
    {
     "method": "POST",
     "url": "/broker-keystone/mint",
     "body": {
      "agent": "support-agent",
      "method": "GET",
      "path": "/orders/1182",
      "body": ""
     }
    },
    {
     "method": "POST",
     "url": "/broker-keystone/attenuate",
     "body": {
      "token": "${0.token}",
      "path": "/orders/*"
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    400,
    403
   ]
  },
  {
   "id": "C07",
   "kind": "attack",
   "claim": "Introspect a garbage token -> alg=none and malformed tokens are inactive.",
   "requests": [
    {
     "method": "POST",
     "url": "/broker-keystone/introspect",
     "body": {
      "token": "eyJhbGciOiJub25lIn0.e30."
     }
    }
   ],
   "path": "active",
   "expect": [
    false
   ]
  }
 ]
}