Day 14 10 min
Second factors
1 / 11 · ≈ 10 min left
Warm-up
From yesterday. Answer from memory: a wrong guess still helps you remember.
Your API verifies RS256 tokens. An attacker sends a token with alg: HS256, signed with HMAC using your public key as the secret. Which PyJWT call refuses it before any key is used?