Demo: attacking token validation (tampering, expiry, audience)
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
prove validation works by trying to break it. Prepares JNR-038-LAB1.
Draft outline details
Step by step
- Change a claim (
rolestoADMIN) without re-signing: the API returns 401. - Wait for or set an expired token: 401.
- Issue a token with the wrong
aud: 401. - Try an unsigned
alg: nonetoken: 401. - Planned mistake: a decoder configured without an audience check accepts the wrong-audience token. Fix: add an audience validator and re-run.
- Turn each attack into an automated test.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.