Write a api which verifies token sent by client and act as protected api route.

0-2 years experience

1. 1How would you implement a middleware in Express that checks the Authorization header for a JWT and returns 401 if it's missing or invalid?
2. 2What happens if the token signature verification fails? How would your code respond?
3. 3If a client sends a token that is expired, how would you detect that and what response would you send?

2-5 years experience

1. 1We need to add role‑based access to a protected route. How would you extend your JWT verification logic to enforce that only users with the 'admin' claim can call the endpoint?
2. 2During testing you notice that some valid tokens are being rejected after a recent deployment. What are possible reasons and how would you debug the issue?
3. 3Explain the trade‑offs between verifying the token on every request versus caching the decoded payload in memory.

5-8 years experience

1. 1At scale we have thousands of requests per second. How would you design the token verification component to minimize latency and avoid a single point of failure?
2. 2Discuss how you would handle key rotation for JWT signing keys without breaking existing clients.
3. 3If we need to support token revocation (e.g., logout), what patterns could you use and what are their performance implications?

8+ years experience

1. 1Our platform is moving from a monolith to microservices, each service needs to validate JWTs issued by a central auth server. How would you design a shared verification library or service to ensure consistency and observability across teams?
2. 2Consider a scenario where we have legacy services that only understand opaque session IDs. How would you plan a migration strategy to JWTs while maintaining backward compatibility?
3. 3What governance and security policies would you put in place to audit JWT usage across the organization, and how would you enforce them in CI/CD pipelines?