HTTPOAuthJWTIntermediate~3h

Auth

Where each one breaks

Sessions, tokens, OAuth and refresh, drilled from the other side: what a stolen cookie buys, what a rotation actually revokes, which flow is wrong for a client that cannot keep a secret. The happy path is in every quickstart. This is the twenty minutes after it fails.

Start this project See the modules

Modules: 5
Drills: 11
Build steps: 2
Time: ~3h

Walk out able to

Hear an incident you have never seen and say what the attacker holds, how long it lasts, and which single line was the defect.

What you drill

Cookies and sessions

Attributes, SameSite, and what a logout really ends.

Tokens and their claims

What a signature proves, and the checks nobody ran.

OAuth flows

The grant this client gets, and what a missing field opens.

Refresh, and the break-in

Rotation, reuse detection, and the window left over.

The pitch

What you practise, and what you leave with

Not an artifact — a reflex. Four incidents answered cold, plus your own live session read attribute by attribute.

You will practise

Cookie attributes, SameSite, and revocation
Token claims and the checks that get skipped
OAuth grants, PKCE and redirect defences
Rotation, reuse detection, exposure windows

Afterwards you can

Say what a stolen credential buys, and how long
Say what a logout or a rotation really revokes
Pick the flow a public client must use
Name the one line that was the defect

Modules

5 modules, 31 items

Lessons explain one idea. Drills repeat it until it sticks. Build steps make something that exists afterwards.

1
What the browser replays
~40 min
Say which credential travels after a login, and who else can hold one.
- LessonWhy the happy path teaches nothing4 min
- LessonWatch a login hand over a key6 min
- LessonWhere the truth about a session lives5 min
- LessonEnd a session on purpose6 min
- DrillSay whether the cookie is sent9 min
- DrillDecide what that actually revokes10 min
2
A token is not a secret
~36 min
Say what a signed token proves, what it hides, and what it never settles.
- LessonRead a token you were handed4 min
- LessonSay what the signature proves5 min
- LessonRun the four checks it leaves open5 min
- LessonPin the algorithm yourself5 min
- DrillName the check that was skipped9 min
- DrillChoose where the token lives8 min
3
Flows, and who they are wrong for
~42 min
Pick the flow a client type must use, and name what a missing field opens.
- LessonWhy handing over a password fails4 min
- LessonFollow the code through two channels5 min
- LessonProve the code belongs to you6 min
- DrillPick the flow for this client8 min
- DrillName what the gap opens10 min
- DrillSend the right token to the door9 min
4
What rotation actually revokes
~34 min
Trace a rotation and a replay, and put a number on what is left afterwards.
- LessonSay why there are two tokens4 min
- LessonWatch rotation expose two holders5 min
- LessonName what revocation cannot reach6 min
- DrillTrace a rotation and a replay9 min
- DrillWork out the exposure window10 min
5
Where each one breaks
~49 min
Answer an incident you have never seen, and read your own live session.
- DrillSay what the theft buys10 min
- DrillDecide if it can be forged9 min
- Build stepRead your own session cookie8 min
- Build stepSee what a script on the page sees5 min
- LessonDiagnose the partner widget5 min
- LessonDiagnose the support ticket4 min
- LessonDiagnose the second sign-in button4 min
- LessonDiagnose the quiet night4 min