Auth middleware swallows errors
An AI agent wrote this middleware to require a valid token on protected routes. It compiles and authorized requests work. What's the subtle security flaw in how it handles failure, and what request would slip through?
Implement
authorize_requests(auth_headers: list[str], valid_tokens: list[str]) → list[str]Examples
in
[["Bearer good1","","Bearer bad"],["good1","good2"]]out["allow","401 missing","401 invalid"]in
[["Bearer"],["good1"]]out["401 malformed"]in
[[],["good1"]]out[]What a strong answer looks like
Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.
0:00 of about 13 min
Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.