What are claims?

Imagine you're building a profile page. You have a JWT stored in the browser. How would you extract the user's display name and email from this token to show it on the UI, and why shouldn't you trust those values for performing sensitive database writes?

We have an API endpoint that should only be accessible for 15 minutes after login. Which standard JWT claims would you look for in the incoming token to enforce this, and what exact checks would your middleware perform?

A junior developer on your team is trying to hide a user's password hash by putting it inside the JWT payload. What would you tell them about how JWT claims are encoded, and why is this a security risk?

We recently added a 'roles' claim to our JWT. A user was just promoted to 'Admin' in the database, but they are complaining they still can't access admin features. What's causing this lag, and how would you resolve it without making a database call on every single API request?

You're debugging an issue where mobile clients are getting '401 Unauthorized' errors intermittently. You suspect it's related to clock skew between the client devices and your servers. Which JWT claims are involved here, and how would you configure your token validation library to handle this gracefully?

We need to implement tenant-isolation in our multi-tenant SaaS application. How would you structure the JWT claims to ensure a user's requests are scoped to their specific organization, and how does the backend verify this claim securely?

Our enterprise clients have users belonging to hundreds of security groups. When we serialize all these groups into the JWT claims, our HTTP headers are hitting size limits and Nginx is throwing 400 Bad Request errors. How would you redesign our token payload or auth flow to solve this 'token bloat' problem?

We are designing a microservices architecture where Service A calls Service B, which calls Service C. How should JWT claims be propagated down the call chain? Should we pass the original user's JWT, mint new service-to-service tokens, or downscope the claims at each hop? What are the security and performance trade-offs?

We need to support immediate session revocation (e.g., if a user's phone is stolen or they log out). Since JWT claims are self-contained and stateless, how would you design a hybrid revocation system that doesn't completely destroy the performance benefits of stateless JWT validation?

We are merging three legacy platforms, each using different identity providers (Active Directory, Okta, and a custom SQL-based auth). We need to establish a unified API gateway that consumes a single standardized JWT. How would you design the claims mapping and translation layer at the gateway level to ensure backward compatibility without rewriting downstream services?

Our organization is moving towards a Zero Trust architecture. How do we design our JWT claims lifecycle, signing key rotation, and token validation policies across multiple cloud environments to ensure that a compromised signing key in one region doesn't compromise the entire global infrastructure?