JWT Token Validator Challenge

Source: Dev.to

Overview

In 2019 Django’s session management framework contained a subtle but catastrophic vulnerability (CVE‑2019‑11358). The framework failed to properly invalidate session tokens after authentication, allowing attackers to hijack user sessions indefinitely. The root cause was an off‑by‑one error in the token expiration check: using bool: instead of a proper comparison.

Token‑validation Exercise

def is_token_valid(current_time: float, expiry: float, token_timestamp: float) -> bool:
    """
    Validate whether an authentication token is still valid.

    Rules:
    - Return False if the token has expired (elapsed >= expiry).
    - Return False if time travel is detected (current_time < token_timestamp).
    
    Examples:
    >>> is_token_valid(1000.0, 600, 1500.0)   # 500 s elapsed
    True
    >>> is_token_valid(1000.0, 600, 1600.0)   # Exactly at expiry
    False
    """
    # Your implementation here
    pass

Edge‑Case Table

Additional Considerations

• Time‑travel detection (current_time < token_timestamp).
• Real‑world security scenarios (session fixation, clock‑skew attacks).