Dashboard
Users
| ID | Username | Role |
|---|
Admin
Unsafe mode (raw reflection / XSS demo): ?
Reset restores users, products and guestbook to seed. Unsafe mode makes Search and Guestbook reflect input without escaping — use only to show the WAF blocking XSS.
JWT / authentication
Issuer
? · Audience ?Key id (kid)
? · keys from env: ?JWKS URI
/.well-known/jwks.jsonGet a token via POST /api/token ({"username","password"}), then call
/secure/* with Authorization: Bearer <jwt>. On F5 point the JWT
provider at the JWKS URI above. Protected: /secure/profile, /secure/users,
/secure/data, /secure/admin/action (admin scope).