Security · Difficulty 1 of 5 · 5 min
A protected route answers anyone
The mobile team reports that calls to the orders route succeed without a valid token: 200 where 401 is expected. Other routes on the same interface answer too. Find the one that carries real business traffic and make it demand a token again.
Where the symptom shows: API Gateway
Take this challenge on a live account
A live AWS account, already broken, and a clock. You fix it with the provider's own console and command line, then read a report of how you worked. We host the cloud account. Nothing lands on your bill.
More challenges
- SecurityOpen to the whole internetS3 · 5 min · level 1
- SecurityStorefront slows down under a traffic surgeElastic Load Balancing · 15 min · level 2
- SecurityInjection attempts reach the applicationElastic Load Balancing · 15 min · level 2
- SecurityInvestigators cannot reconstruct an intrusionCloudTrail · 45 min · level 4
- SecurityDefences look active but let everything throughElastic Load Balancing · 45 min · level 4
- SecurityA regulated data set fails its auditS3 · 90 min · level 5