- DPoP: the boundaries - 3 questions
- JWT access tokens: the validation calls - 3 questions
- Browser-based apps: architecture beats storage - 3 questions
- The authorization-code flow - 3 questions
- The device flow - 3 questions
From the teaching page.
A DPoP-bound access token leaks into a log file. An attacker replays the bare token string with Authorization: Bearer at a resource server that supports both DPoP and bearer. What happens?
From the teaching page.
A resource server receives a JWT access token: correct issuer, audience matches, signature verifies against the AS key, not expired - but the typ header reads "JWT", not "at+jwt". Accept it?
From the teaching page.
A pure SPA isolates its tokens perfectly: worker-held, in-memory, never touching a readable surface. Which attack from the RFC still works against it?
From the teaching page.
The redirect lands on your client with code and state in the query string. What does a correct client do first?
From the teaching page.
Your device client is polling the token endpoint and receives an authorization_pending error, then a slow_down error. What is the correct response to slow_down?