All quizzesHard
Authorization & Failure Modes — Series 3
Preview — 3 of 10 questions
An access token remains valid after a user changes their password. What design can invalidate previously issued tokens early?
ATrack a token version or revocation state and check it during authentication
BRemove the exp claim
CReturn the old token in a response header
DAdd more routes to OpenAPI
A developer logs complete Authorization headers for failed requests. What should change?
ALog the tokens only for administrator users
BRedact credentials while retaining safe error metadata
CCopy tokens to /docs
DPut tokens in query parameters instead
A validly signed JWT carries a future nbf claim. What should a validator that enforces nbf do before that time?
AAccept it because exp is later
BConvert nbf into a scope
CReject it as not yet valid
DIgnore the signature
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.