Lesson test: Tokens, and when a JWT is the wrong answer

Sign in

Libre University uses your GitHub account. Signing in is only needed to sit a final test, so the score is kept on your profile.

Tokens, and when a JWT is the wrong answer

1.[2p]
The payload of a signed JWT is hidden from anyone holding the token.

True

The answer is: False

False

Correct

2.[3p]
Match each registered claim to what it asserts.

which service the token was minted for
who issued this token
who the token is about
the moment after which it must be refused

Show the answer

iss: who issued this token sub: who the token is about aud: which service the token was minted for exp: the moment after which it must be refused

3.[3p]
An attacker sets the header to `{"alg":"none"}`, edits the payload and removes the signature. What makes this work when it works?

The verifier reads the algorithm out of the token instead of deciding it in code

Correct

The signature is only checked when the payload changes

The answer is: The verifier reads the algorithm out of the token instead of deciding it in code

Base64url decoding accepts a missing third segment

The answer is: The verifier reads the algorithm out of the token instead of deciding it in code

The exp claim is checked before the signature

The answer is: The verifier reads the algorithm out of the token instead of deciding it in code

4.[3p]
In an algorithm confusion attack against an RS256 issuer, what does the attacker use as the HMAC key?

The issuer's public key, which is public by design

Correct

The kid value from the header

The answer is: The issuer's public key, which is public by design

The base64url header segment

The answer is: The issuer's public key, which is public by design

A key recovered from a previous token's signature

The answer is: The issuer's public key, which is public by design

5.[3p]
Access tokens live 15 minutes and revocation is by expiry alone. On average, how many minutes does a revoked token keep working?

CorrectNot quite: 7.5

6.[3p]
A team adds a `jti` denylist checked on every request and still calls the design stateless. What is the accurate description?

The lookup is back, so the architecture matches a session table with a smaller store

Correct

Statelessness is preserved because the denylist holds only revoked tokens

The answer is: The lookup is back, so the architecture matches a session table with a smaller store

The denylist replaces the need to check exp

The answer is: The lookup is back, so the architecture matches a session table with a smaller store

The design is stateless as long as the denylist is in memory

The answer is: The lookup is back, so the architecture matches a session table with a smaller store

7.[3p]
In which situations does a signed token genuinely beat a server-side session?

Select all that apply

One service verifying a caller's identity when there is no shared session store

Correct

An edge worker that must decide in microseconds and cannot reach the database

Correct

An OpenID Connect ID token verified by a party that cannot query the issuer

Correct

Browser login for a single application with one database

The answer is: One service verifying a caller's identity when there is no shared session store, An edge worker that must decide in microseconds and cannot reach the database, An OpenID Connect ID token verified by a party that cannot query the issuer

8.[3p]
Refresh token rotation with reuse detection turns theft into what?

A detectable event with a bounded window, since a second use of a spent token revokes the whole family

Correct

An impossible attack, since the stolen token never verifies

The answer is: A detectable event with a bounded window, since a second use of a spent token revokes the whole family

A silent failure that resolves at the next expiry

The answer is: A detectable event with a bounded window, since a second use of a spent token revokes the whole family

A rate-limiting problem handled by the login endpoint

The answer is: A detectable event with a bounded window, since a second use of a spent token revokes the whole family

9.[2p]
A token carries `role` and an admin demotes the user. What kind of data should never travel inside the token? One word.

CorrectNot quite: authorization

1.[2p] The payload of a signed JWT is hidden from anyone holding the token.

2.[3p] Match each registered claim to what it asserts.

3.[3p] An attacker sets the header to {"alg":"none"}, edits the payload and removes the signature. What makes this work when it works?

4.[3p] In an algorithm confusion attack against an RS256 issuer, what does the attacker use as the HMAC key?

5.[3p] Access tokens live 15 minutes and revocation is by expiry alone. On average, how many minutes does a revoked token keep working?

6.[3p] A team adds a jti denylist checked on every request and still calls the design stateless. What is the accurate description?

7.[3p] In which situations does a signed token genuinely beat a server-side session?

8.[3p] Refresh token rotation with reuse detection turns theft into what?

9.[2p] A token carries role and an admin demotes the user. What kind of data should never travel inside the token? One word.

1.[2p]
The payload of a signed JWT is hidden from anyone holding the token.

2.[3p]
Match each registered claim to what it asserts.

3.[3p]
An attacker sets the header to `{"alg":"none"}`, edits the payload and removes the signature. What makes this work when it works?

4.[3p]
In an algorithm confusion attack against an RS256 issuer, what does the attacker use as the HMAC key?

5.[3p]
Access tokens live 15 minutes and revocation is by expiry alone. On average, how many minutes does a revoked token keep working?

6.[3p]
A team adds a `jti` denylist checked on every request and still calls the design stateless. What is the accurate description?

7.[3p]
In which situations does a signed token genuinely beat a server-side session?

8.[3p]
Refresh token rotation with reuse detection turns theft into what?

9.[2p]
A token carries `role` and an admin demotes the user. What kind of data should never travel inside the token? One word.