Protected Routes Quiz

Which auth state should generally not be trusted by itself for API security?

A client-side boolean such as isAdmin
A client-side boolean can be changed by the user. Sensitive API access must be enforced on the server.
Server-side authorization middleware
A signed server session
A validated access token on the server

Next Question (17/20)

Question 17 of 20 in Protected Routes Quiz