What is JWT?
JWT is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted, as it is digitally signed.
- 1
It is a method to implement authorization in the application
- 2
It is a token that only the server can generate, and can contain a payload of data.
- 3
JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
- 4
Signed tokens can verify the integrity of the claims contained within it, while encrypted tokens hide those claims from other parties
- 5
A JWT payload can contain things like user ID so that when the client sends you a JWT, you can be sure that it is issued by you, and you can see to whom it was issued.
Scenario Questions
0-2 years experience
- 1We need to add a login endpoint that returns a JWT after verifying credentials. Walk me through how you'd generate the token and what you'd put in its payload.
- 2If a client sends a JWT in the Authorization header and the token is expired, what should your API return and why?
- 3How would you store the secret key used to sign JWTs in a Node.js service?
2-5 years experience
- 1Our microservice started rejecting valid JWTs after we rotated the signing key. How would you troubleshoot and fix the issue?
- 2When implementing role‑based access with JWT claims, what trade‑offs do you consider between embedding permissions in the token versus fetching them from a DB on each request?
- 3Explain why using JWTs for session revocation can be problematic and how you would mitigate it in a high‑traffic API.
5-8 years experience
- 1Design a token‑validation layer for a fleet of services that need to support multiple signing algorithms and key rotation without downtime.
- 2At scale, how does the size of JWTs impact performance, and what strategies would you use to keep latency low?
- 3We need to support both short‑lived access tokens and long‑lived refresh tokens using JWTs. Describe the flow and security considerations.
8+ years experience
- 1Our organization is moving from opaque session IDs stored in a central DB to JWTs across many legacy services. What architectural changes and migration plan would you propose to minimize risk?
- 2How would you evaluate the decision to adopt JWTs versus OAuth2 opaque tokens for a multi‑tenant SaaS platform, considering compliance, audit, and cross‑team ownership?
- 3Discuss how you would implement a zero‑downtime key rotation strategy for JWT signing keys that satisfies both security policies and continuous deployment pipelines.
Follow-up Questions
- What could happen if the signing secret is accidentally leaked?
- When would you choose an asymmetric algorithm over a symmetric one for JWTs?
- How would you implement token revocation in a horizontally scaled service?