SecureMidSecurityAuto-graded

Fix a login that never verifies JWT signatures

Core authentication knowledge: whether a candidate recognizes a login that trusts whatever the client hands it.A login service authenticates users by validating their HS256 JWT, and the helper meant to do it is broken in the most dangerous way available: it base64-decodes the payload and trusts it, without ever checking the signature. That is the classic JWT auth bypass — anyone can forge a token for any user with any role and be waved through. Make verify_jwt actually secure, including the alg: none trick and the expiry boundary.

35 min

python

Start lab

You're done when

A genuine, correctly signed token is accepted.
A token whose payload has been tampered with is rejected.
A token signed with the wrong secret is rejected.
A token declaring alg: none is rejected rather than treated as trivially valid.
An expired token is rejected, and one expiring exactly at the current instant is treated as expired.
Malformed tokens are rejected without raising.
The signature comparison is constant-time, so it does not leak the secret through timing.

What it measures

Application securityRecognising that decoding is not verification, and that the unverified path is the whole vulnerability.

CryptographyVerifying an HMAC correctly, rejecting algorithm confusion, and comparing digests in constant time.

Boundary rigourGetting expiry exactly right at the equality case, where an off-by-one keeps a dead token alive.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

35 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo