All quizzesMedium
API Security Patterns — Series 2
Preview — 3 of 10 questions
An app needs revocable access to a specific user's files with limited scopes. What fits better than a shared application-wide API key?
AOne permanent API key shared by every user and integration.
BA public client identifier treated as a confidential bearer secret.
CUser-delegated OAuth tokens scoped to the required access.
DA token granting every available scope to simplify future features.
A refresh token has been rotated, then the old token is presented again. What should a rotation-aware system consider?
AA reason to accept both refresh tokens indefinitely.
BProof that the access token's signature algorithm is broken.
CA guarantee that the legitimate user has logged out everywhere.
DInvestigate reuse and apply the token-family policy.
A cross-origin simple POST reaches a server, but its response lacks permission for the calling script to read it. Which conclusion is correct?
AAdding an Origin header makes the user automatically authorized.
BThe server necessarily received no request because CORS blocked it.
CNo CSRF defense is needed because the response is unreadable.
DThe browser may hide the response even though server-side effects occurred.
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.