Get unstuck

Hint 1: Do not decode and trust

This function receives verified claims. A real integration must reject unverified tokens before calling it.

Hint 2: Avoid type coercion

A string expiration can pass a numeric comparison. Check the numeric type explicitly.

Reveal the reference patch and explanation
Fixedtoken-policy.mjsJavaScript
export function acceptClaims(c, now) {
  const audiences = typeof c.aud === 'string' ? [c.aud] : c.aud;
  return c.iss === 'https://id.example' && c.token_use === 'access'
    && typeof c.sub === 'string' && c.sub.trim().length > 0
    && Array.isArray(audiences) && audiences.every(a => typeof a === 'string')
    && audiences.includes('invoices-api')
    && Number.isInteger(c.exp) && c.exp > now
    && (c.nbf === undefined || Number.isInteger(c.nbf) && c.nbf <= now);
}

At now=1000, exp=1100 passes and exp=1000 is expired. nbf=1001 fails; nbf=1000 is permitted. invoices-api in an audience array passes, while invoices-api-admin does not. The string "1100" is malformed under this contract rather than coerced. Subject identity is otherwise preserved exactly; trim is used only to reject whitespace-only values, not to rewrite a subject identifier.

Compare it with your own fix, then rerun the tests. The editor is not changed when you open this explanation.

Inspect the actual test harness

The browser and the lab download run the same cases, including cases that catch common wrong fixes, such as comparing with one fixture value instead of the real rule. The download includes the complete test adapter and cryptographic fixtures.

Download cases.mjs
How the browser sandbox runs your code

Your code runs in QuickJS 2025-09-13 (quickjs-emscripten 0.32.0) inside a Web Worker, isolated from the page, with a 32 MiB memory limit and a 2.5-second time limit. The test cases and the pass or fail verdict run outside that sandbox, so changing built-ins such as Array.prototype.push cannot change the result. The lab download runs the same cases under Node.js, where your code runs directly.

The same as in current Node.js:

  • ES2025 syntax and built-ins, including Set methods such as intersection, iterator helpers, Promise.try, RegExp.escape and the RegExp v flag

Added to the sandbox so that it behaves like Node.js:

  • structuredClone, Array.fromAsync, queueMicrotask, atob and btoa
  • URL and URLSearchParams, parsed by your browser’s own URL implementation
  • TextEncoder and TextDecoder for UTF-8
  • Intl.Collator and a locale-aware String.prototype.localeCompare
  • console.log and related methods, whose output appears with your results

Not available in the browser sandbox:

  • Timers (setTimeout, setInterval), fetch and other network or storage APIs; the exercises are deterministic and offline
  • Node.js modules and globals: import, require, process and Buffer
  • Web Crypto (crypto.getRandomValues, crypto.subtle); each workshop supplies the cryptographic operations it needs
  • Intl other than Collator: toLocaleString and toLocaleDateString ignore the locale, so numbers have no digit grouping and dates use one fixed format in the device’s time zone
  • using declarations, Symbol.dispose and DisposableStack (explicit resource management)
  • Uint8Array.fromBase64 and toBase64, JSON.rawJSON, Atomics and Error.captureStackTrace

Use the lesson in your own system

This exercise validates a deliberately strict claims profile only. token_use is a provider-specific convention here; integer-only NumericDate values and zero skew are fixture decisions, not requirements for every JWT deployment. It does not parse or verify JWTs, implement OAuth/OIDC, select signing keys or model revocation. A real integration uses the issuer’s documented access-token profile and a maintained protocol library before applying its application-specific checks.

Your next task: Can your API accidentally accept an ID token or a token minted for an adjacent service?

RFC 8725: JWT best current practices

Related guide: JWT validation: algorithms, keys, claims and key rollover