Lion Cipher Lab
Build a FAPI 2.0-conformant authorization server (and prove it by rejecting every bad request)
- Identity & Access Management
- Advanced
- ~90 min
- Free · no account required
Why it matters
Bearer tokens are the soft underbelly of OAuth: steal the string and you are the user, no questions asked. That is tolerable for a to-do app and unacceptable for money, health records, or anything an attacker would fight for. FAPI 2.0 is the high-security profile the financial world settled on precisely to close that gap, and 'we do OAuth' means nothing next to 'we pass a FAPI conformance suite.' Assembling the profile yourself -- and then watching a stolen token bounce off the resource server -- turns a pile of RFC acronyms into an instinct for which controls actually stop token theft and…
What you'll learn
- FAPI 2.0 Security Profile
- Pushed Authorization Requests (PAR)
- PKCE S256
- sender-constrained tokens (DPoP)
- issuer identification / mix-up defense
- building a conformance test battery
Steps in this lab
- What FAPI 2.0 is, and when to reach for it
- Rule 1 - PAR is mandatory (kill the front channel)
- Rule 2 - PKCE S256 and exact redirect matching
- Rule 3 - sender-constrained tokens with DPoP (the anti-theft control)
- Rule 4 - issuer identification defeats the mix-up attack
- Write the server: paste the whole file
- Run the conformance battery and read every line
- What you actually built, and the judgment to keep