Incident Dossier

The Token That Never ExpireChecked

Auth tokens minted for a 15-minute session work happily for hours after their real expiry. The session store shows `exp` written correctly; the verify path simply never reads it. Other teams report that they can use tokens whose `exp` has passed, but tokens they minted a moment ago get bounced. `now` is injected so the failure is reproducible on demand; no real clock involved.

Initial failing signalisTokenValid returns true for a token whose exp is 50s in the pastExpected behavior: isTokenValid({exp:150,...}, 200) === false · actual behavior: isTokenValid({exp:150,...}, 200) === true

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Read the isTokenValid function. It checks something, but is it checking `exp`?
Trace what claim each side of the comparison is reading.
Pick the right claim and the right direction so `exp` in the past fails and `exp` in the future passes.

Focus Mode

Start

src/jwt-verify.js

Likely area

src/jwt-verify.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecrets & Auth

DifficultyEasy

Est. time12 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace