What is JWT?

JWT is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted, as it is digitally signed.

1
It is a method to implement authorization in the application
2
It is a token that only the server can generate, and can contain a payload of data.
3
JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
4
Signed tokens can verify the integrity of the claims contained within it, while encrypted tokens hide those claims from other parties
5
A JWT payload can contain things like user ID so that when the client sends you a JWT, you can be sure that it is issued by you, and you can see to whom it was issued.

Difficulty: 5/10

Topics: token generation, signature verification, key management

Scenario Questions

0-2 years experience

1
We need to add a login endpoint that returns a JWT after verifying credentials. Walk me through how you'd generate the token and what you'd put in its payload.
2
If a client sends a JWT in the Authorization header and the token is expired, what should your API return and why?
3
How would you store the secret key used to sign JWTs in a Node.js service?

2-5 years experience

1
Our microservice started rejecting valid JWTs after we rotated the signing key. How would you troubleshoot and fix the issue?
2
When implementing role‑based access with JWT claims, what trade‑offs do you consider between embedding permissions in the token versus fetching them from a DB on each request?
3
Explain why using JWTs for session revocation can be problematic and how you would mitigate it in a high‑traffic API.

5-8 years experience

1
Design a token‑validation layer for a fleet of services that need to support multiple signing algorithms and key rotation without downtime.
2
At scale, how does the size of JWTs impact performance, and what strategies would you use to keep latency low?
3
We need to support both short‑lived access tokens and long‑lived refresh tokens using JWTs. Describe the flow and security considerations.

8+ years experience

1
Our organization is moving from opaque session IDs stored in a central DB to JWTs across many legacy services. What architectural changes and migration plan would you propose to minimize risk?
2
How would you evaluate the decision to adopt JWTs versus OAuth2 opaque tokens for a multi‑tenant SaaS platform, considering compliance, audit, and cross‑team ownership?
3
Discuss how you would implement a zero‑downtime key rotation strategy for JWT signing keys that satisfies both security policies and continuous deployment pipelines.

Follow-up Questions

❓What could happen if the signing secret is accidentally leaked?
❓When would you choose an asymmetric algorithm over a symmetric one for JWTs?
❓How would you implement token revocation in a horizontally scaled service?