A slate-roof guild API is reachable with no Authorization header. What should the developer implement so unauthenticated calls fail?
Select an answer to reveal the explanation.
Short Explanation
An open API with no header check is basically a unlocked door. Validate the Entra access token—or send back 401 and keep the guild’s data inside.
Full Explanation
Protect the slate-roof guild API by requiring a Microsoft Entra bearer access token and validating issuer, audience, lifetime (and signature via signing keys). If the Authorization header is missing or the token fails validation, return HTTP 401 Unauthorized. That pattern closes anonymous access and aligns API authorization with the identity platform.
Returning HTTP 200 with an empty body when the header is missing fails because a success status teaches clients and intermediaries that the call worked. It also leaves data or side effects reachable depending on how the handler continues, which is the opposite of failing closed.
Accepting any Base64 string without checking claims fails because encoding is not authentication. Attackers can send arbitrary Base64; without signature, iss, aud, and exp validation, the API cannot trust identity or roles.
Requiring only a client IP allowlist and skipping JWT validation fails because IP controls are coarse, break for mobile and NAT scenarios, and do not identify the caller or carry roles/scopes. Network allowlists can complement zero trust but do not replace token validation for an Entra-protected API.
Exam caveat: use 401 for missing/invalid authentication and 403 when the token is valid but lacks the required role or scope. Mixing those statuses confuses clients and hides whether the fix is “sign in” versus “get permission.”
Operational check: call the API with no header and expect 401; call with a token whose aud is another API and expect 401; call with a valid token for this API and expect success only when roles/scp authorize the operation. Confirm middleware uses Entra metadata for signature keys rather than hard-coded secrets.