All quizzesHard
Authorization & Failure Modes
Preview — 3 of 10 questions
A JWT signature is valid but the token has expired. Which result is appropriate for a protected route?
AReject the credential before authorization
BAccept it because the signature matches
CRe-sign it with a new expiration automatically
DTreat it as an API key
An endpoint requires reports:write, while the validated token grants only reports:read. What must happen?
AAccept because both scopes start with reports
BDeny the write operation
CAdd reports:write to the token
DAsk OpenAPI to change the requirement
A developer decodes a JWT payload without verifying its signature and trusts role="admin". What is the flaw?
AThe token cannot contain roles
BFastAPI always verifies role automatically
CA caller can forge an unverified role claim
DOpenAPI removes the claim
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.