SecureMidSecurityAuto-graded

Fix a CSRF check that accepts forged tokens

Security theatre and real protection look alike from outside, and telling them apart is the point of the exercise.The app defends against cross-site request forgery with the signed double-submit pattern: on GET it issues a token bound to the user's session, placed in a cookie and in the form; on POST it verifies the submitted token is one it genuinely issued for that session. An attacker can make the browser POST but cannot read the session id or forge a bound token — provided the implementation is sound. A security review says this one is not.

30 min

python

Start lab

You're done when

A genuine token issued for the current session is accepted.
A token issued for a different session is rejected.
A tampered token is rejected.
A token signed with the wrong secret is rejected.
An empty or missing token is rejected.
A predictable forged token is rejected, and the nonce is genuinely unpredictable.
The token comparison is constant-time rather than a naive equality check.

What it measures

Application securityUnderstanding what binds a CSRF token to a session and which failures let an attacker forge one.

Security and privacy designGenerating unpredictable nonces and verifying signatures in the way the pattern actually requires.

Constant-time verificationComparing secrets without leaking through timing, a detail reviews catch and implementations routinely miss.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

30 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo