▸case-05 To keep tokens small and processing fast, our IoT platform signs JWTs using ECDSA with P-256 curve and SHA-256 (ES256). Write Python code to generate ES256 signed tokens and verify their signatures. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 An API endpoint processes incoming JWT tokens. An attacker attempts to submit a token with header {"alg": "none"} and no signature segment. Write a Python verification check that ensures tokens specifying alg=none or missing signature parts are strictly rejected. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 A client sends a JWT with header {"alg": "HS256", "typ": "JWT"} signed using an RSA public key acting as a symmetric HMAC secret. Developers often pass public key files directly into generic JWT decode calls. Write a Python function using JWT libraries that verifies incoming tokens while preventing this algorithm confusion attack. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 Our high-throughput microservice architecture uses Ed25519 signatures (EdDSA) for JWT authentication. Write a Python script using standard cryptography and JWT libraries to generate and verify an EdDSA-signed JWT. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 We need a Python function to issue and verify short-lived internal service JWTs using symmetric HMAC-SHA256 (HS256). Show how to sign a payload containing sub and exp claims with a 256-bit secret key, and verify it safely. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 Distributed systems often suffer from minor clock drift between authorization servers and API gateways, causing valid tokens to fail nbf or exp checks immediately after issuance. Show how to configure clock skew leeway during JWT claim validation in Python. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 Explain the format of a compact serialized JWT string according to RFC 7519, including how each of the three sections is separated and encoded. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 A service issues tokens that become valid only at a future timestamp designated by the nbf (Not Before) claim. Show how to enforce nbf validation in Python during JWT verification. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-26 We store static API keys in our database for third-party developer integrations. When a client presents an API key in the X-API-Key HTTP header, how should we securely store and verify these keys in Python without leaking them via timing attacks? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 An attacker intercepts a valid JWT and alters the role claim in the payload from 'user' to 'admin' without modifying the signature segment. Demonstrate in Python how JWT signature verification detects this payload tampering. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-24 We are configuring session cookie security parameters for a web application running behind a TLS-terminating reverse proxy. Provide Python Flask session cookie configuration settings to protect against XSS token theft and cross-site request forgery. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 To prevent token replay attacks during the brief validity window of an access token, an application includes a unique jti (JWT ID) claim. Write Python code demonstrating how to check and store jti identifiers in a cache to reject replayed tokens. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 When choosing between HS256, RS256, and ES256 for a distributed web architecture where third-party microservices need to verify tokens issued by a central auth server, which algorithm class should be selected and why? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 An API resource server receiving a JWT must ensure the token was explicitly intended for it by checking the aud (Audience) claim. Show how to configure JWT verification to strictly enforce the expected audience value. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-25 Our Python mobile API backend client connects to an internal service over HTTPS. We want to implement custom HTTP public key pinning or custom CA certificate validation using Python's requests library. Provide a Python script demonstrating how to pass a custom CA bundle or pin certificate verification in requests. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 Our authorization server must sign JWT access tokens using RSA with SHA-256 (RS256) so microservices can verify tokens using only the public key. Write a Python snippet that signs a payload with an RSA private key and verifies it with the matching RSA public key. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 A developer wants to sign HS256 tokens using a simple string secret like 'secret128'. What is the cryptographic risk, and what key generation practice should be enforced for HS256 in Python? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 A multi-tenant microservice accepts JWTs but must ensure tokens originate exclusively from https://auth.example.com. Write Python code that validates the iss (Issuer) claim during JWT decoding. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 Write a Python authentication middleware function that extracts a Bearer token from the Authorization header, verifies its JWT signature using RS256, validates expiration and audience, and attaches the validated claims to the request state. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 We are building an OAuth 2.0 authorization server that issues access tokens. We need to implement the Authorization Code Flow with PKCE for native mobile clients. Provide Python code using standard libraries to create the code_verifier and compute the corresponding code_challenge using SHA-256 (S256). | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 A client attempts to submit a JWT token whose exp claim timestamp is in the past. Write a Python snippet that validates the exp claim during verification and raises or returns an authorization error when expired. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 To prevent token mixing attacks where an access token is submitted to an endpoint expecting an ID token or explicit OAuth access token, how should the JWT header typ field be set and validated? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 Our OAuth provider rotates RSA signing keys periodically. Incoming JWT headers include a kid (Key ID) parameter. Write Python logic that uses the header's kid to select the correct public key from a JWK Set (JWKS) dictionary before verifying the signature. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 An attacker includes an inline public key inside the JWT header using the jwk parameter and signs the token with their own matching private key. How should a Python JWT verification handler defend against this key injection technique? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 Our API requires JWT tokens to contain a custom tenant_id claim matching the sub-domain tenant identifier. Write Python code that validates both standard claims and custom claims from the decoded JWT payload. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 An application issues short-lived JWT access tokens (15 minutes) alongside long-lived refresh tokens. Contrast the security requirements and validation mechanisms for JWT access tokens versus refresh tokens. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |