Lubinik Updater Authentication & REST

Training mode

Lubinik Updater Authentication & REST

Time remaining:

0 / 20 answered

1. Where can the remote updater secret be read from?

Where can the remote updater secret be read from? A frontend JavaScript object packages.json A protected PHP constant or environment variable A public REST response

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
2. What status class is returned when the site has no configured remote secret?

What status class is returned when the site has no configured remote secret? Server configuration error, HTTP 500 Redirect to login HTTP 404 package missing Successful anonymous access

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
3. Which headers are required for signed requests?

Which headers are required for signed requests? Theme and plugin version Timestamp, nonce, and signature Cookie, referer, and language ETag and content type only

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
4. What is the timestamp freshness window in the authenticator?

What is the timestamp freshness window in the authenticator? Unlimited One second 300 seconds 30 days

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
5. Why must the timestamp pass ctype_digit?

Why must the timestamp pass ctype_digit? It selects a backup The signature protocol expects a Unix timestamp represented by digits It is a package version It is a nonce hash

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
6. How is a used nonce tracked?

How is a used nonce tracked? A transient keyed by an MD5-derived nonce identifier A user cookie only A public JSON file The package slug

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
7. When is the nonce transient stored?

When is the nonce transient stored? Never After package installation only Before checking required headers Only after the HMAC signature has validated

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
8. Which values form the signed base string?

Which values form the signed base string? Only the URL Package and user password Uppercase method, path, timestamp, nonce, and raw body separated by newlines Only the JSON body

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
9. Why is the parsed request path included rather than an arbitrary client label?

Why is the parsed request path included rather than an arbitrary client label? It generates a backup name It binds the signature to the actual REST route It verifies GitHub It selects the theme

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
10. What security property comes from signing the raw body?

What security property comes from signing the raw body? Changing package parameters invalidates the signature The nonce is unnecessary The response is cached The body becomes encrypted

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
11. Why compare signatures with hash_equals?

Why compare signatures with hash_equals? It checks capabilities It decrypts HMAC It provides timing-attack-resistant equality comparison It validates JSON

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
12. Does HMAC encrypt the update request body?

Does HMAC encrypt the update request body? No, it authenticates integrity and origin Only on HTTPS Yes, SHA-256 hides the body Only for POST

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
13. Which route is read-only status reporting?

Which route is read-only status reporting? /update /update-batch /rollback /wp-json/lubinik-updater/v1/status

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
14. Where is remote authentication connected to each REST route?

Where is remote authentication connected to each REST route? sanitize_callback only wp_footer template_include permission_callback

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
15. Which REST method category is used for an update?

Which REST method category is used for an update? READABLE/GET DELETE only CREATABLE/POST HEAD only

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
16. How does update-batch report individual package failures?

How does update-batch report individual package failures? Each slug receives its own ok/message/code result Failures are omitted The whole response always fatals It rolls back every prior package automatically

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
17. What happens when the local version is already current?

What happens when the local version is already current? The package is reinstalled The endpoint returns 404 A successful changed=false response is logged and returned A rollback runs

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
18. Why trim leading v or V before version_compare?

Why trim leading v or V before version_compare? It validates signatures It selects GitHub repos It removes prerelease data Tags such as v1.2.0 can be compared with local 1.2.0

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
19. Why does updater self-update require confirm_self_update?

Why does updater self-update require confirm_self_update? All packages require it It bypasses HMAC The updater cannot be a plugin Replacing the remote agent itself has elevated recovery risk

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.
20. Why reuse the signed request nonce as request_id in logs?

Why reuse the signed request nonce as request_id in logs? It becomes a package version It disables replay protection It names the WordPress user It correlates one remote request with its operations without exposing the secret

Hint
Follow authentication, validation, backup, replacement, and evidence boundaries.

1. Where can the remote updater secret be read from?

2. What status class is returned when the site has no configured remote secret?

3. Which headers are required for signed requests?

4. What is the timestamp freshness window in the authenticator?

5. Why must the timestamp pass ctype_digit?

6. How is a used nonce tracked?

7. When is the nonce transient stored?

8. Which values form the signed base string?

9. Why is the parsed request path included rather than an arbitrary client label?

10. What security property comes from signing the raw body?

11. Why compare signatures with hash_equals?

12. Does HMAC encrypt the update request body?

13. Which route is read-only status reporting?

14. Where is remote authentication connected to each REST route?

15. Which REST method category is used for an update?

16. How does update-batch report individual package failures?

17. What happens when the local version is already current?

18. Why trim leading v or V before version_compare?

19. Why does updater self-update require confirm_self_update?

20. Why reuse the signed request nonce as request_id in logs?