DON'T RUN IT BACK (jti Replay)

[Intro] Yeah, yeah, check it Crew, say it wid mi Signature valid, but a yuh ting, sure? [Verse 1] Engineer resend di same client_assertion, Same signed JWT, knock di door again, Token endpoint go issue anodda access token, Signature check pass, but nobody check di reuse, Verify it, yes, but reject it? Nah, di gap deh inna di code, Signed once nuh mean single-use, understand? [Chorus] Don't run it back, don't run it back! Fresh jti every time, nuh mek it lack! Track di replay, lock it down tight, Reject di one already used, day and night! Crew: DON'T RUN IT BACK! Aud pin, exact recipient, nuh loose ting, Wrong audience, bounce it, wi nah sing! [Verse 2] RFC 7523 say di assertion authenticate di client, But a grant still needed fi finish di request, Replay tracking limit repeat use, Audience pinning limit where it get accepted, yuh see? Neither one replace di other, test dem both, First reuse an acceptable one, den wrong aud, see di oath! [Bridge] Atomic check and record, one move, no gap, Share di state cross every node, nuh slip inna di trap, Fail closed when replay store down, test dat path, Documentation nuh proof, controlled negative tests fi di math! [Outro] Signature nuh make it single-use, say it again! Track di jti, pin di aud, every time, amen! Crew: DON'T RUN IT BACK! DON'T RUN IT BACK!