▸case-01 In an Express.js application using `express-session`, an engineer proposes keeping the pre-login session ID upon successful password verification to preserve temporary cart items stored in `req.session`. How should session handling be implemented during login? | fail→fail | 23,963 | 19,509 | -19% | 1 | 1 | 0% | 2,094 | 2,560 | +22% | 0 | 0 | — |
▸case-02 A Node.js REST API verifies incoming Bearer JWT signatures using the public key and checks `exp`. The developer asserts that if the JWT signature is valid, the request is fully authorized to fetch `/api/documents/:id` directly from the database query `SELECT * FROM docs WHERE id = :id`. What additional check is required? | pass→pass | 14,233 | 13,475 | -5% | 1 | 1 | 0% | 1,387 | 1,717 | +24% | 0 | 0 | — |
▸case-03 To debug intermittent 401 Unauthorized errors in an API gateway, an engineer adds a middleware that logs all request headers (including `Authorization: Bearer <token>`) and request body payloads containing `password` to Winston logger. Evaluate this logging implementation. | pass→pass | 23,586 | 181,757 | +671% | 1 | 1 | 0% | 2,491 | 3,533 | +42% | 0 | 0 | — |
▸case-04 A mobile client makes concurrent API requests when waking up, triggering multiple simultaneous calls to `/auth/refresh`. The backend generates a new refresh token on each call and updates the database record with `UPDATE refresh_tokens SET token = :newToken WHERE user_id = :userId`. What flaw exists in this token lifecycle implementation and how should it be resolved? | fail→pass | 23,903 | 35,916 | +50% | 1 | 1 | 0% | 2,967 | 3,710 | +25% | 0 | 0 | — |
▸case-05 A web application sets `Set-Cookie: session=...; HttpOnly; Secure; SameSite=Strict`. The security team asks whether explicit CSRF protection (like anti-CSRF tokens or custom request headers) is still required for state-changing cross-origin requests and API endpoints. | pass→pass | 28,031 | 40,464 | +44% | 1 | 1 | 0% | 2,547 | 3,267 | +28% | 0 | 0 | — |
▸case-06 An Express.js application deployed behind an AWS Application Load Balancer terminates TLS at the load balancer and forwards HTTP to Express. The developer configured `cookie: { secure: true }` in `express-session`, but users report cookies are never set in their browsers. What configuration issue is present? | pass→pass | 8,162 | 7,959 | -2% | 1 | 1 | 0% | 1,227 | 1,728 | +41% | 0 | 0 | — |
▸case-07 A development team places `JWT_PRIVATE_KEY` directly inside `config/default.json` in their Git repository so all microservices can read it easily. How should JWT signing keys and API secrets be stored and managed? | pass→pass | 16,495 | 23,006 | +39% | 1 | 1 | 0% | 2,439 | 3,263 | +34% | 0 | 0 | — |
▸case-08 In a GraphQL microservice, database repositories contain direct checks like `if (user.role !== 'admin') throw new Error()`. How should authorization checks be structured between API controllers, policy decision points, and database access layers? | pass→pass | 23,989 | 48,584 | +103% | 1 | 1 | 0% | 3,302 | 4,005 | +21% | 0 | 0 | — |
▸case-09 A high-throughput API service uses `crypto.createHash('sha256').update(password).digest('hex')` to hash passwords before storing them in PostgreSQL to maximize authentication performance. Evaluate this password storage mechanism. | pass→pass | 94,364 | 21,765 | -77% | 1 | 1 | 0% | 2,334 | 2,935 | +26% | 0 | 0 | — |
▸case-10 An OAuth2 client implementation constructs the authorization URL as `https://auth.example.com/oauth/authorize?response_type=code&client_id=123&redirect_uri=...` without passing or verifying a `state` parameter. What vulnerability is created and how should it be fixed? | pass→pass | 19,832 | 139,897 | +605% | 1 | 1 | 0% | 2,528 | 3,071 | +21% | 0 | 0 | — |
▸case-11 A single-page application implements logout by executing `localStorage.removeItem('jwt_token')` and redirecting to `/login`. The JWT has a 24-hour expiration time. What security risk remains and how should server-side logout be handled? | pass→pass | 19,255 | 22,912 | +19% | 1 | 1 | 0% | 2,304 | 3,123 | +36% | 0 | 0 | — |
▸case-12 A REST API checks if `jwt.payload.scope.includes('admin')` to grant full system administrative access to a user. Why is treating OAuth2 scopes as equivalent to user roles security-flawed? | pass→pass | 23,063 | 18,885 | -18% | 1 | 1 | 0% | 2,287 | 2,957 | +29% | 0 | 0 | — |
▸case-13 An identity service connects to its PostgreSQL database using `USER=postgres` to simplify running migrations and managing tenant tables. How should database access permissions be structured for an authentication service? | pass→pass | 23,856 | 24,746 | +4% | 1 | 1 | 0% | 2,655 | 3,764 | +42% | 0 | 0 | — |
▸case-14 A user authentication endpoint accepts POST requests to `/api/v1/login` without rate limiting or login failure tracking, relying only on user password strength. How should the system protect against brute-force credential stuffing attacks? | pass→pass | 24,805 | 19,946 | -20% | 1 | 1 | 0% | 2,252 | 3,405 | +51% | 0 | 0 | — |
▸case-15 A native iOS app implements OAuth2 authorization code grant using a static `client_secret` hardcoded in the app bundle. What risk does this present and what OAuth extension should be used instead? | pass→pass | 16,465 | 11,837 | -28% | 1 | 1 | 0% | 1,656 | 2,277 | +38% | 0 | 0 | — |
▸case-16 An authentication service logs successful logins in an HTTP access log, but discards failed login attempts and password reset requests to minimize disk log storage. What security and compliance issues does this raise? | pass→pass | 26,382 | 24,454 | -7% | 1 | 1 | 0% | 2,686 | 3,091 | +15% | 0 | 0 | — |
▸case-17 In a distributed microservice system, service A issues JWTs that service B validates. Service B intermittently rejects valid tokens with `TokenNotYetValidError` due to small time discrepancies between server clocks. How should JWT timestamp verification handle clock drift? | pass→pass | 20,582 | 19,606 | -5% | 1 | 1 | 0% | 2,329 | 2,731 | +17% | 0 | 0 | — |
▸case-18 A web application requires users to enter a 2FA code before accessing financial settings. After 2FA verification, the backend sets `req.session.is2FA = true` on the existing session ID without modifying the session token. What risk exists and how should step-up auth handle sessions? | pass→pass | 20,429 | 21,164 | +4% | 1 | 1 | 0% | 2,351 | 2,680 | +14% | 0 | 0 | — |
▸case-19 A GraphQL API disables introspection in production and hides `ssn` from public documentation, assuming this prevents unauthorized clients from querying the field. How should sensitive fields in GraphQL schemas be secured? | pass→pass | 19,620 | 27,825 | +42% | 1 | 1 | 0% | 2,334 | 3,767 | +61% | 0 | 0 | — |
▸case-20 A multi-tenant SaaS application queries data using `SELECT * FROM data WHERE tenant_id = req.headers['x-tenant-id']`. The `x-tenant-id` header is passed directly from the frontend request header. What authorization flaw exists? | pass→pass | 15,109 | 8,634 | -43% | 1 | 1 | 0% | 1,436 | 1,729 | +20% | 0 | 0 | — |
▸case-21 A REST API server attempts to support cross-origin authentication requests by sending `Access-Control-Allow-Origin: *` along with `Access-Control-Allow-Credentials: true`. Browsers reject these responses. What is the correct CORS configuration for credentialed requests? | pass→pass | 16,004 | 16,469 | +3% | 1 | 1 | 0% | 1,729 | 2,242 | +30% | 0 | 0 | — |
▸case-22 A user management system handles password resets by generating a 6-digit PIN, storing it in the `users` table as `reset_pin`, and sending it via email. The PIN does not expire. What security flaws exist in this password reset design? | pass→pass | 14,776 | 19,931 | +35% | 1 | 1 | 0% | 2,401 | 2,682 | +12% | 0 | 0 | — |
▸case-23 We are designing the frontend login page for our React application using Tailwind CSS. We need styling for the modal dialog, flex layout for center alignment, and copy for the error message when a user enters invalid credentials. Please provide the React component CSS classes and user-facing text. | pass→pass | 20,202 | 19,901 | -1% | 1 | 1 | 0% | 2,623 | 2,871 | +9% | 0 | 0 | — |
▸case-24 We are setting up an AWS Application Load Balancer to distribute HTTP traffic to two nginx instances serving static image assets. Provide the Terraform code for the ALB target group and listener rule on port 80/443 without modifying any auth services or identity providers. | pass→pass | 18,060 | 18,844 | +4% | 1 | 1 | 0% | 3,219 | 3,129 | -3% | 0 | 0 | — |
▸case-25 We are conducting a third-party compliance audit of a legacy vendor portal. We cannot modify any code, database schemas, or auth policies on their system. Produce an audit checklist report evaluating their external interface against standard compliance requirements. | pass→pass | 40,041 | 28,851 | -28% | 1 | 1 | 0% | 4,237 | 3,917 | -8% | 0 | 0 | — |