All quizzesHard
Authorization & Failure Modes — Series 2
Preview — 3 of 10 questions
An API accepts an access token whose signature is valid but whose aud names a different service. What should its verifier do when audience is required?
AReject the token as intended for another recipient
BAccept because the signature is valid
CChange aud in memory and continue
DFall back to an API key automatically
A token decoder uses the unverified JWT header's alg to choose its accepted algorithm list. Why is that unsafe?
AThe header is always encrypted
BAn attacker-controlled header can steer verification policy
CFastAPI forbids JWT headers
DIt makes the exp claim optional
A route extracts a valid API key, but the key belongs to a read-only client and the route writes data. What must authorization check?
AOnly whether the key has 32 characters
BOnly whether the request uses HTTPS
CThe key's permitted operations, not just its existence
DOnly the OpenAPI security scheme name
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.