Test token reuse, fixation, impersonation, and privilege boundaries

Prove the target boundary

Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.

GET http://127.0.0.1:5177/health

Test token reuse

Connect to /ws-secure, send logout, then attempt a new secure connection with the same token. Compare /ws-insecure behavior and label the endpoint.

Test session fixation

Send session_fixation with an operator-chosen lab ID. Secure must require a server-generated session; insecure accepts the supplied value.

Test impersonation and privilege

As User A send impersonate/set_role claims for admin. Secure denies client-trusted identity changes; insecure returns identity_updated.

Test channel boundaries

Use foreign-room subscribe and event_replay cases for subscription spoofing and channel-boundary violation. Do not count public ping as a boundary failure.

Run bounded races

Use exactly two parallel actions, one wave, no retry, and a reset endpoint where available. Preserve timing, final state, and cancellation behavior.