[Question] About introspection

R

Rajat•4/17/25, 1:04 PM

hi @SNB can you explan more on
"But when trying to access the tasks with a slightly tampered token, I also get 200 and still can see the tasks.

"
did you mean that you tampered the token and it still passed?.
can you share more on it?. Example curl request perhaps?
thanks

R

Rajat•4/17/25, 2:20 PM

it fails for me

curl -i -H "Authorization: Bearer <malformed token>" http://localhost:8089/api/tasks

curl -i -H "Authorization: Bearer <malformed token>" http://localhost:8089/api/tasks

curl -i -H "Authorization: Bearer <malformed token>" http://localhost:8089/api/tasks

curl -i -H "Authorization: Bearer <malformed token>" http://localhost:8089/api/tasks

HTTP/1.1 401 Unauthorized
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Thu, 17 Apr 2025 14:17:00 GMT
Content-Length: 13
unauthorized

HTTP/1.1 401 Unauthorized
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Thu, 17 Apr 2025 14:17:00 GMT
Content-Length: 13
unauthorized

HTTP/1.1 401 Unauthorized
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Thu, 17 Apr 2025 14:17:00 GMT
Content-Length: 13
unauthorized

HTTP/1.1 401 Unauthorized
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Thu, 17 Apr 2025 14:17:00 GMT
Content-Length: 13
unauthorized

curl -i -H "Authorization: Bearer <correct token>" http://localhost:8089/api/tasks

curl -i -H "Authorization: Bearer <correct token>" http://localhost:8089/api/tasks

curl -i -H "Authorization: Bearer <correct token>" http://localhost:8089/api/tasks

curl -i -H "Authorization: Bearer <correct token>" http://localhost:8089/api/tasks

HTTP/1.1 200 OK
Content-Type: application/json
Date: Thu, 17 Apr 2025 14:17:03 GMT
Content-Length: 62

{"tasks":["My new task","create a new task on /api/add-task"]}%

HTTP/1.1 200 OK
Content-Type: application/json
Date: Thu, 17 Apr 2025 14:17:03 GMT
Content-Length: 62

{"tasks":["My new task","create a new task on /api/add-task"]}%

HTTP/1.1 200 OK
Content-Type: application/json
Date: Thu, 17 Apr 2025 14:17:03 GMT
Content-Length: 62

{"tasks":["My new task","create a new task on /api/add-task"]}%

HTTP/1.1 200 OK
Content-Type: application/json
Date: Thu, 17 Apr 2025 14:17:03 GMT
Content-Length: 62

{"tasks":["My new task","create a new task on /api/add-task"]}%

SSNB But you showed the correct **malformed** is working, it shouldn't be the case.

R

Rajat•4/17/25, 3:19 PM

hi @SNB my bad, but that was a typing mistake, I am surprised how it worked for you, I might havo check internally