All activities
SECURITY / 25-minute workshop
Run a miniature threat-model session
Walk through likely attacks and what your server must enforce.
REAL-WORLD SCENARIO
Work through the decision.
An attacker captures a completed browser verification interaction and tries to replay it for a second action.
Your objective
Identify trust boundaries and tests that prevent stale or substituted evidence.
Deliverable: A short abuse-case table with attack, impact, detection, and mitigation.
Activity steps
0 of 3 steps complete
Your work is saved on this device only.
Worked example
Replay attempt: a consumed token is reused. Expected response: reject the request and log a bounded error code without storing the raw proof.
Quality check
- List assets and attacker capabilities.
- Address replay and client-side manipulation.
- Specify a negative-path integration test.
GO DEEPER
Continue with the source guide.
The companion guide provides the reasoning and trade-offs behind the exercise.
Read the companion guide