Tokens, and when a JWT is the wrong answer
1.[2p] The payload of a signed JWT is hidden from anyone holding the token.
The payload of a signed JWT is hidden from anyone holding the token.
The answer is: False
2.[3p] Match each registered claim to what it asserts.
Match each registered claim to what it asserts.
iss
sub
aud
exp
which service the token was minted for
who issued this token
who the token is about
the moment after which it must be refused
Show the answer
iss: who issued this token sub: who the token is about aud: which service the token was minted for exp: the moment after which it must be refused
3.[3p] An attacker sets the header to {"alg":"none"}, edits the payload and removes the signature. What makes this work when it works?
An attacker sets the header to {"alg":"none"}, edits the payload and removes the signature. What makes this work when it works?
The answer is: The verifier reads the algorithm out of the token instead of deciding it in code
The answer is: The verifier reads the algorithm out of the token instead of deciding it in code
The answer is: The verifier reads the algorithm out of the token instead of deciding it in code
4.[3p] In an algorithm confusion attack against an RS256 issuer, what does the attacker use as the HMAC key?
In an algorithm confusion attack against an RS256 issuer, what does the attacker use as the HMAC key?
The answer is: The issuer's public key, which is public by design
The answer is: The issuer's public key, which is public by design
The answer is: The issuer's public key, which is public by design
5.[3p] Access tokens live 15 minutes and revocation is by expiry alone. On average, how many minutes does a revoked token keep working?
Access tokens live 15 minutes and revocation is by expiry alone. On average, how many minutes does a revoked token keep working?
6.[3p] A team adds a jti denylist checked on every request and still calls the design stateless. What is the accurate description?
A team adds a jti denylist checked on every request and still calls the design stateless. What is the accurate description?
The answer is: The lookup is back, so the architecture matches a session table with a smaller store
The answer is: The lookup is back, so the architecture matches a session table with a smaller store
The answer is: The lookup is back, so the architecture matches a session table with a smaller store
7.[3p] In which situations does a signed token genuinely beat a server-side session?
In which situations does a signed token genuinely beat a server-side session?
Select all that apply
The answer is: One service verifying a caller's identity when there is no shared session store, An edge worker that must decide in microseconds and cannot reach the database, An OpenID Connect ID token verified by a party that cannot query the issuer
8.[3p] Refresh token rotation with reuse detection turns theft into what?
Refresh token rotation with reuse detection turns theft into what?
The answer is: A detectable event with a bounded window, since a second use of a spent token revokes the whole family
The answer is: A detectable event with a bounded window, since a second use of a spent token revokes the whole family
The answer is: A detectable event with a bounded window, since a second use of a spent token revokes the whole family
9.[2p] A token carries role and an admin demotes the user. What kind of data should never travel inside the token? One word.
A token carries role and an admin demotes the user. What kind of data should never travel inside the token? One word.