Auth Token Inspector
Inspect authentication scenarios and choose safe backend decisions for tokens, scopes, sessions, CSRF, and object-level authorization.
- Time
- 6-9 minutes
- Concept
- Authentication, authorization, sessions, and token safety
Use categories to choose a backend skill path, understand why that area matters, then jump into a short playable scenario.
Review how backend systems decide whether a request is authenticated, authorized, protected from CSRF-style browser behavior, and safe from common token handling mistakes.
3 focused game(s) for this category.
Inspect authentication scenarios and choose safe backend decisions for tokens, scopes, sessions, CSRF, and object-level authorization.
Trace Authorization Code flow failures across state, PKCE, redirect URI, token exchange, and session boundaries.
Secure account recovery against enumeration, token theft, replay, concurrent use, and stale sessions.
3 game(s) in this concept area.
3 focused game(s) for this category.
Tune Bloom-filter capacity, hash count, verification, saturation, and deletion behavior without introducing false negatives.
Choose BFS or DFS, place visited checks, handle cycles, and cover disconnected graph components.
Recognize monotonic-stack, interval-merge, heap, and probabilistic membership signals from problem constraints.
Learn how cache hits, misses, TTL, LRU eviction, stale data, and cache warming affect latency, correctness, and backend load.
1 focused game(s) for this category.
Predict cache hits and misses as requests flow through an LRU cache, then experiment with TTL behavior and stale data tradeoffs.
Practice incident response and resilience decisions, including observability signals, circuit breakers, dependency failure handling, and recovery tradeoffs.
7 focused game(s) for this category.
Diagnose dependency failures and choose circuit breaker, timeout, fallback, retry, half-open, and bulkhead strategies that reduce blast radius.
Propagate deadlines, cancellation, bulkheads, and bounded fallbacks across dependency failure windows.
Diagnose retry scenarios and choose safe idempotency behavior for payments, emails, imports, orders, PUT updates, and scarce inventory.
Control queue growth, adaptive concurrency, health probes, and priority-aware load shedding during overload.
Triage production incidents by choosing useful metrics, logs, traces, queue signals, database evidence, request ids, and alerting strategies.
Triage blocking chains, slow-query regressions, expand-contract changes, and resource-safe database rollouts.
Route SLO alerts, assign incident roles, mitigate reversibly, and verify recovery with durable evidence.
Practice the request and response decisions that shape reliable backend APIs: HTTP semantics, REST route design, CORS boundaries, webhook verification, and client-facing error behavior.
4 focused game(s) for this category.
Guide browser API requests through CORS decisions covering origins, preflight, credentials, exposed headers, and cache safety.
Design REST-style methods and routes for product requirements such as creating users, updating email, searching products, and nested comments.
Choose the correct HTTP status code for realistic backend scenarios and learn the response semantics behind each answer.
Investigate webhook requests and choose safe handling for signatures, replay windows, retries, idempotency, and durable acknowledgement.
4 game(s) in this concept area.
4 focused game(s) for this category.
Build, attest, and promote one minimal immutable container artifact.
Preserve serving capacity through scheduling, autoscaling, disruption, and rollout changes.
Recover workload failures using controller, Pod, probe, dependency, and business evidence.
Connect Deployments, Services, configuration, identity, probes, and termination.
Strengthen database judgment around indexes, transaction isolation, migration safety, query shape, write overhead, and production rollback planning.
11 focused game(s) for this category.
Connect durability, MVCC, plan evidence, and connection budgets.
Recover pool, lock, replication, and failover incidents without losing business truth.
Read waits-for cycles, choose safe victims, retry complete transactions, and prevent recurring deadlocks.
Choose composite and partial indexes while accounting for MVCC churn, bloat, and partition lifecycle.
Choose explicit consistency or availability behavior for concrete network-partition scenarios.
Investigate PostgreSQL query plans, cardinality gaps, scan choices, join amplification, and rollout evidence.
Route reads across primary and replicas while respecting lag, freshness contracts, failover, and workload isolation.
Translate RPO and RTO into backup, point-in-time recovery, restore testing, and isolation decisions.
Choose safe zero-downtime database migration steps for expanding schemas, backfilling data, rolling out indexes, enforcing constraints, and recovering from failures.
Choose the best database index for simplified schemas and queries while learning full scans, covering indexes, sort avoidance, and composite order.
Defend database invariants from concurrent requests by choosing transactions, locks, constraints, snapshot reads, and optimistic concurrency.
5 game(s) in this concept area.
5 focused game(s) for this category.
Classify failures, bound retries, quarantine poison messages, and replay dead-letter work with approval and idempotency.
Trace producer, broker, consumer, acknowledgment, crash, and redelivery boundaries to name the real delivery guarantee.
Build duplicate-safe consumers with scoped event identity, database constraints, and atomic business mutations.
Recover a transactional outbox relay across commit, publish-confirm, duplicate delivery, and poison-event failure windows.
Coordinate durable Saga state, local transactions, compensations, timeouts, and manual recovery.
2 game(s) in this concept area.
2 focused game(s) for this category.
Follow validators through browser, CDN, and origin while handling 304 responses, representation variants, purge, and bounded staleness.
Choose browser and shared-cache policies for public, personalized, validated, and variant API responses.
2 game(s) in this concept area.
2 focused game(s) for this category.
Practice event boundaries, CloudEvents envelopes, semantic compatibility, and safe schema evolution.
Control partition keys, consumer rebalances, ordering gaps, and hot-partition recovery.
1 game(s) in this concept area.
1 focused game(s) for this category.
Recover event systems through ambiguous publication, backlog control, and business reconciliation.
7 game(s) in this concept area.
7 focused game(s) for this category.
Bound executor admission, compose failures, and stop work after deadlines.
Protect Java visibility, compound invariants, atomic updates, and lock ordering.
Read unified GC evidence and compare G1 and ZGC through controlled, reversible service experiments.
Separate retained heap, allocation churn, metaspace, stacks, direct buffers, RSS, and container memory pressure.
Correlate thread dumps, safepoints, CPU, JFR, dependencies, and container evidence into bounded JVM hypotheses.
Measure JIT compilation, code cache, warmup, AOT training, and capacity with explicit guardrails and rollback.
Operate virtual threads, structured child tasks, scoped context, and pinning evidence.
Work through traffic management choices such as load balancing, rate limiting, overload protection, least connections, sticky sessions, and horizontal scaling.
2 focused game(s) for this category.
Route simulated traffic across backend servers using round robin, weighted round robin, least connections, and random strategies.
Choose rate limiting designs for realistic backend traffic patterns, from public APIs and login endpoints to queues, webhooks, and retry storms.
Explore asynchronous processing tradeoffs such as retry limits, queue depth, poison messages, dead-letter queues, idempotency, and worker throughput.
1 focused game(s) for this category.
Tune workers, retries, and dead-letter behavior while jobs move through an async queue with failures and poison messages.
3 game(s) in this concept area.
3 focused game(s) for this category.
Direct incident response with RED, USE, service-level indicators, burn rates, and explicit recovery criteria.
Build trustworthy Spring telemetry contracts with explicit ownership, bounded cardinality, and evidence-quality checks.
Build a bounded telemetry path for structured logs, trace context, sampling, batching, and safe attributes.
3 game(s) in this concept area.
3 focused game(s) for this category.
Place Spring transactions, JPA fetch plans, rollback rules, and validated configuration at production boundaries.
Sequence Spring Security, health probes, PostgreSQL Testcontainers, mitigation, and incident recovery.
Design Spring controllers, validation, service delegation, and safe Problem Details responses.