The goal
The previous five lessons tested individual pieces: password hashing, JWT verification, flow selection, session lifetime, account enumeration. This lesson tests what none of them can: a complete flow where every step is right and the combination is wrong.
This is the hardest class of authentication bug and also the most common in real systems, because each step was written by a different person at a different time, and nobody reads the whole flow in one sitting.
The situation. A web app with a backend, using OIDC with Zitadel as the identity provider. The login flow has six steps, one serious vulnerability and two smaller problems. The serious one is not in any single step.
What to produce.
- Read all six steps once through before judging anything.
- Find the hole that allows account takeover — not the one that leaks information.
- Write the patch, and state which variants it stops and which it does not.
The only hint: the serious hole is where two steps trust each other. Each checks its own part correctly and assumes the other checked the rest.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…