grceng.academy
Review lab 40 bonus XP

Review identity release claims

Start labRead the room

Objectives

The release owner says every item is safe because the sign-in screen requires MFA. Review each independent claim against the described implementation; do not infer protections that are not stated.

Accept claims that are technically sound. Reject flawed claims using exactly one root-cause code: weak-storage for unsuitable password storage, factor-category for non-independent factors, token-purpose for using the wrong token at an API, or object-boundary for missing server-side object checks.

Verdicts are accept or reject. Every rejection needs one reason code from: weak-storage | factor-category | token-purpose | object-boundary.

Release claims with implementation facts

AA-1 Passwords use a fast unsalted digest; TLS makes database disclosure harmless.
AA-2 Password plus memorised PIN counts as two independent MFA factors.
AA-3 API accepts an ID token intended for the browser client because its signature is valid.
AA-4 Invoice download checks only invoices:read; hidden links prevent cross-clinic access.
AA-5 Server rotates session identifiers at login, rejects the old identifier, and invalidates the current session on logout.
AA-6 Role grants invoice reading, while a server-side policy denies requests with a mismatched clinic or missing relationship attribute.

Checks the server runs (3)

  • Every line in the fixture carries a verdict
  • Accept and reject land on the right lines
  • Each rejection cites a valid reason code

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the request before the artefact

    Read each line as a claim paired with implementation facts. Decide what attack the claimed protection actually prevents.

  2. Step 2

    Judge every line, including the boring ones

    Give every fixture entry a verdict, including safeguards that work. Do not turn this into a list containing only suspected defects.

    Every line in the fixture carries a verdict

  3. Step 3

    Separate what is wrong from what is merely ugly

    Test the reasoning against database theft, independent login evidence, token audience, direct object requests and session reuse. Strong sign-in does not repair every later boundary.

    Accept and reject land on the right lines

  4. Step 4

    Say why, in the vocabulary the programme uses

    For a rejection choose the root failing rather than a downstream symptom. For an acceptance leave the reason empty; avoid inventing an unmentioned defect.

    Each rejection cites a valid reason code

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.