How to complete the challenge POST /api/secret/note (403)

By Alan Richardson · Published 2026-07-31

Use POST /api/secret/note with a valid JSON note payload and include an X-AUTH-TOKEN header, but make the token value invalid.

The API can see an auth token was supplied, but it does not match the current challenger, so the response should be 403.

Try it now

POST /api/secret/note with a wrong auth token to trigger 403

Lessons Learned

• A wrong X-AUTH-TOKEN blocks the write even when the note payload is otherwise valid.
• 403 Forbidden protects existing secret note state from tokens that look present but are not trusted.
• Testing invalid authorization should include confirming that state did not change afterward.

Suggested Experiments

• Try to write with a fake token, then read with a real token to check the note stayed unchanged.
• Use a valid token from a different X-CHALLENGER and compare it with a completely made-up token.

Experiment with this endpoint