09-jwt-invalid-signature

Tampered credentials

Invalid JWT signature

JWT body claims look valid, but the signature was produced by a key NOT in the JWKS Envoy fetches. Signature verification fails.

jwtdenysignature

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

signWithWrongKeytrue

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS401

BYPASSES OPAREJECTED BEFORE EXT_AUTHZ — OPA NOT CONSULTED

What this demonstrates

The credential's signature doesn't verify — it was forged or altered. The request is rejected before reaching any AI system.

Integrity / anti-tampering

RUNNER

Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves cryptographic signature is required — no token-forging works.