Advanced Security Exercises¶

Use these exercises after completing the foundation labs.

Token validation¶

Complete LAB-009 by testing valid, altered, expired, wrong-issuer, and wrong-audience JWTs against Spring Security's resource-server support.

Delegation¶

Complete LAB-022 and LAB-023. Compare direct token relay with token exchange, then verify a downstream token cannot be used at an unrelated audience.

Browser security¶

Complete LAB-024. Keep OAuth tokens server-side, use a secure session cookie, and prove CSRF protection and logout behavior.

Workload identity¶

Complete LAB-021 and LAB-025. Compare scoped Client Credentials with mTLS-bound workload identity and document the rotation process.

See the Advanced Patterns Reference and Lab Roadmap for acceptance criteria.