grceng.academy
Review lab 40 bonus XP

Review the HTTP assurance notes

Start labRead the room

Objectives

A release reviewer claims any encrypted exchange is authorized and any stateless protocol cannot support sessions. Review six assurance notes before they reach the audit packet.

Accept technically correct claims and reject incorrect ones using the narrowest listed reason. Reason codes mean: method-semantics = incorrect method guarantees; auth-boundary = identity confused with permission; cookie-boundary = cookie protection overstated; state-model = protocol and application state confused.

Verdicts are accept or reject. Every rejection needs one reason code from: method-semantics | auth-boundary | cookie-boundary | state-model.

Release assurance notes

AHW-1: DELETE is idempotent even if the first response is 204 and a later response is 404.
AHW-2: GET may charge a card as its intended action because safe means encrypted.
AHW-3: This service returns 401 for expired credentials, so 401 proves the user's billing role was checked and refused.
AHW-4: HttpOnly stops direct script cookie API reads but does not stop all authenticated requests initiated by malicious script.
AHW-5: Secure alone prevents CSRF because encrypted cookies cannot accompany attacker-triggered requests.
AHW-6: Stateless HTTP makes a server-side session store impossible.

Checks the server runs (3)

  • Every line in the fixture carries a verdict
  • Accept and reject land on the right lines
  • Each rejection cites a valid reason code

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the request before the artefact

    Treat each note as a testable claim, not as a vote on whether the release is generally secure.

  2. Step 2

    Judge every line, including the boring ones

    Give every supplied note one verdict, including claims that are already precise.

    Every line in the fixture carries a verdict

  3. Step 3

    Separate what is wrong from what is merely ugly

    Look for overreach: a valid narrow guarantee does not establish a different security property.

    Accept and reject land on the right lines

  4. Step 4

    Say why, in the vocabulary the programme uses

    For each rejected note, identify whether the confusion concerns operation effects, identity, browser cookie behavior, or the storage of application state.

    Each rejection cites a valid reason code

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.