Sign in to RatAuth. Demo account: demo / demo. Your session is a JWT cookie named session shaped {sub,uid,role,exp}. Decode it first (paste it into jwt.io / jwt_tool) before you touch anything — the header tells you the algorithm, and that is where this whole lab lives.
Goal: reach /admin as role:admin. There is more than one way to mint that token — and the verifier is generous. Public key material is published; a stubborn signature is worth questioning; and not every endpoint bothers to check the signature at all.