Auth Lab — Keys and Bearer

Prove key + bearer gates on 127.0.0.1:8812 —.

Auth Lab — Keys and Bearer• Audio Walkthrough

00:00/03:17

Visual · auth_lab_keys_bearer

Lab: X-API-Key and Bearer. Bind 127.0.0.1:8812.

Two credentials. Four curls. Notes that show 401 and success — without a phishing kit in sight.

Lessons 1–3 covered keys, bearer/sessions, and authn vs authz. This lab records: no creds → 401; API key → allowed path; bearer → allowed path; low-priv bearer → privileged deny if the toy supports it. All on 127.0.0.1:8812. Original Cyberlium. Refuse 0.0.0.0. Never hydra, never sqlmap, never OAuth phishing pages. Next: Quiz — API Authentication.

1. Lab contract: GATE and bind

. STOP if router. Start the auth toy on 127.0.0.1:8812 only. Load lab credentials from a 600 env file — fake strings.

Write the expected matrix before curling: none/key/bearer/privileged.

Command guide

Try these commands — Lab contract: GATE and bind

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Auth0 tokens — https://auth0.com/docs/secure/tokens/access-tokens (handling concepts) OWASP API2 — https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install openssl

macOS: Built-in

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install openssl

═══ LINUX / macOS ═══

Command — copy this

LAB_KEY=$(openssl rand -hex 12); echo "generated lab key prefix: ${LAB_KEY:0:8}..."
curl -sS -H "Authorization: Bearer lab-token" -H "X-Request-ID: $(openssl rand -hex 4)" http://127.0.0.1:8812/me
curl -sS -o /dev/null -w "expired token %{http_code}
" -H "Authorization: Bearer expired" http://127.0.0.1:8812/me

Primary tools to practice this lesson: curl, openssl. Reference sites: Auth0 tokens (https://auth0.com/docs/secure/tokens/access-tokens); OWASP API2 (https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Run the matrix and save evidence

curl without creds, with X-API-Key, with Authorization: Bearer. Save -D - transcripts. If /admin exists, show deny with user token.

Label each transcript authn vs authz in the note so Module 4 JWT does not blur them.

3. Cleanup

Stop YOUR pid. chmod 600. Scrub any accidental real secrets. Confirm no phishing kit files landed in cyberlium-lab.

Quiz is next — it will APPLY the matrix, not ask you to attack SaaS.

4. What you ship: a four-row auth matrix from YOUR lab

none→401, key success, bearer success, privileged deny if available. Bind 127.0.0.1:8812. DEMO GATE. No hydra/sqlmap/phishing.

5. What you record before the next lesson

Date. Matrix statuses. Fake creds only. File t13-m03-l04-auth-lab.txt chmod 600.

6. Wrong vs right: stranger APIs vs literacy on systems you own

Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.

Wrong: hydra the lab “to be sure.” Deploy an OAuth phishing page. Bind 0.0.0.0 so phones can auth.
Right: Matrix on loopback. Next: Quiz — API Authentication.

Hands-on Exercise