Write a api in next js to implement JWT token generation

Q: Write a api in next js to implement JWT token generation

import jwt from 'jsonwebtoken' export default function handler(req, res) { const jwtSecretKey = process.env.DIY_JWT_SECRET const { username, password } = req.body // confirm if password is valid if (password !== 'pikachu') { return res.status(401).json({ message: 'Invalid password' }) } let data = { signInTime: Date.now(), username, } const token = jwt.sign(data, jwtSecretKey) res.status(200).json({ message: 'success', token }) }

Difficulty: 5/10

Next.js API Routes, JWT Authentication, Token Security

javascript

Scenario Questions

0-2 years experience

1Imagine we are building a simple login endpoint in Next.js. How would you write a Route Handler that takes a username and password, verifies them, and signs a JWT with a 15-minute expiration using an environment variable for the secret?
2If you accidentally hardcoded the JWT secret key in your Next.js API route file instead of using `process.env`, what are the security risks, and how does Next.js prevent or expose this during a production build?

2-5 years experience

Follow-up Questions

How would you handle token revocation if a user's password is changed?
Why might you choose the `jose` library over `jsonwebtoken` in a Next.js Edge runtime environment?
What are the security implications of storing this JWT in localStorage versus an httpOnly cookie?