Headers
Browser Security Headers Pack: SAMPLE
SAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.
- File
- HEADERS · Headers
- Use case
- API testing
Security
The security category is a first-class hub for auth and PKI SAMPLE fixtures, published sample-only material that must never be used as a real identity. It deepens certificate and key coverage under permanent /files/security/… paths (the older data/security paths remain shipped and unchanged). Expect self-signed X.509 certificates and CSRs, RSA/Ed25519 keys, PKCS#12 SAMPLE bundles, JWT algorithm variants (none/HS/RS), JWKS documents, OAuth token-response JSON, CORS and CSP header text, htpasswd variants, and SSH known_hosts samples. Every private key and token is labelled SAMPLE and deliberately committed for parser, TLS, and auth-harness tests.
Filter security on Browse · 135 files · 8 subcategories
Results start with a representative from each related test family. Use a card’s variant menu or the filters below to reach a specific format, profile, or failure case; every sample retains its own detail page and download.
Frequently asked questions
Are these real certificates or secrets?
Never. Every key, cert, JWT, and token is published SAMPLE-only material under /files/security/…, do not use them as real identities. Older data/security paths remain shipped and unchanged.
What JWT algorithms are included?
SAMPLE JWTs for none, HS256/384/512, and RS256/384/512, plus expired and intentionally invalid tokens, JWKS, and OAuth token-response JSON.
Do you include CORS and CSP examples?
Yes, plain-text header fixtures for CORS, CSP, HSTS, and a deliberately misconfigured CORS sample for policy linters.
Start with one example from each use-case group, then continue through its other test families. Choose a use case, search, or filter to find a specific profile; a card’s variant menu contains its related samples.
More filters and sorting
Results
53 test families · 135 available files · Page 1 of 3
Htpasswd
htpasswd (APR1 MD5): SAMPLE
SAMPLE htpasswd using Apache APR1 MD5-style hash for legacy Basic-auth tests.
- File
- HTPASSWD · Htpasswd
- Use case
- Certificate & key testing
Jwks
JWKS (Empty Keys): SAMPLE
Empty JWKS keys array for edge-case JWKS loaders.
- File
- JSON · Jwks
- Use case
- JWT / JWKS testing / Error handling
Jwt
JWT (HS256 Expired): SAMPLE
SAMPLE HS256 JWT with a past exp claim, for expiry-validation harnesses.
- File
- JWT · Jwt
- Use case
- JWT / JWKS testing / Error handling
Oauth
OAuth Device Code Response: SAMPLE
SAMPLE OAuth device-authorization response for device-flow client tests.
- File
- JSON · Oauth
- Use case
- JWT / JWKS testing / API testing
Pgp
OpenPGP Public Key (ASCII Armor): SAMPLE Shape
ASCII-armored SAMPLE-shaped PGP public key placeholder for armor detectors (not a cryptographically valid key).
- File
- TXT · Pgp
- Use case
- Certificate & key testing
Pki
CRL Metadata JSON: SAMPLE
SAMPLE CRL metadata JSON (no binary CRL) for revocation-list UI and loader tests.
- File
- JSON · Pki
- Use case
- Certificate & key testing
Ssh
SAMPLE OpenSSH Public Key: ECDSA P-256
The P-256 public key in OpenSSH form, whose blob names the curve twice, once in the key type and once inside the payload. Parsers that read only one of the two mis-handle mismatched keys.
- File
- PUB · Ssh
- Use case
- Certificate & key testing
Headers
Content-Security-Policy Header: SAMPLE
SAMPLE CSP header line for CSP parsers and security-header scanners.
- File
- HEADERS · Headers
- Use case
- API testing
Htpasswd
htpasswd (bcrypt): SAMPLE
SAMPLE htpasswd with a bcrypt hash line for Basic-auth file parsers.
- File
- HTPASSWD · Htpasswd
- Use case
- Certificate & key testing
Jwks
SAMPLE JWK: EC P-256 Public Key
A single P-256 public JWK. Its x and y are fixed 32-byte base64url values, left-padded when a coordinate happens to be short: the padding rule that libraries stripping leading zeroes get wrong.
- File
- JSON · Jwks
- Use case
- JWT / JWKS testing
Jwt
JWT (HS256): SAMPLE
SAMPLE JWT with alg=HS256 for auth parsers and algorithm-handling tests. Published sample material only.
- File
- JWT · Jwt
- Use case
- JWT / JWKS testing
Oauth
OAuth Error: Insufficient Scope
OAuth 2.0 SAMPLE error JSON (insufficient_scope) for client error-path tests.
- File
- JSON · Oauth
- Use case
- JWT / JWKS testing / Error handling
Pki
Ed25519 Private Key (PEM): SAMPLE
Deterministic SAMPLE Ed25519 private key for SSH/TLS tooling tests.
- File
- KEY · Pki
- Use case
- Certificate & key testing
Ssh
SSH authorized_keys: SAMPLE
Single-entry SAMPLE authorized_keys file for SSH access-control parsers.
- File
- TXT · Ssh
- Use case
- Certificate & key testing
Headers
CORS Misconfigured Headers: SAMPLE
Intentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
- File
- HEADERS · Headers
- Use case
- API testing / Error handling
Htpasswd
htpasswd (Mixed Algorithms): SAMPLE
Multi-user SAMPLE htpasswd mixing bcrypt, APR1, and {SHA} lines for algorithm-detection tests.
- File
- HTPASSWD · Htpasswd
- Use case
- Certificate & key testing
Jwks
SAMPLE JWKS: Keys Without kid
A JWK Set whose keys carry no kid at all, which RFC 7517 permits. Verifiers must then fall back to trying candidates by algorithm, and the ones that index the set by kid alone find nothing.
- File
- JSON · Jwks
- Use case
- JWT / JWKS testing / Error handling
The use-case group filter replaces the long list of category sections.