Write a api which verifies token sent by client and act as protected api route.

Q: Write a api which verifies token sent by client and act as protected api route.

import jwt from 'jsonwebtoken' export default function handler(req, res) { const tokenHeaderKey = 'jwt-token' const jwtSecretKey = process.env.DIY_JWT_SECRET const token = req.headers[tokenHeaderKey] try { const verified = jwt.verify(token, jwtSecretKey) if (verified) { return res.status(200).json({ safehouseKey: 'under-the-doormat', message: 'success' }) } else { // Access Denied return res.status(401).json({ message: 'error' }) } } catch (error) { // Access Denied return res.status(401).json({ message: 'error' }) } }

Difficulty: 5/10

JWT verification, middleware, token revocation

javascript

Scenario Questions

0-2 years experience

1How would you implement a middleware in Express that checks the Authorization header for a JWT and returns 401 if it's missing or invalid?
2What happens if the token signature verification fails? How would your code respond?
3If a client sends a token that is expired, how would you detect that and what response would you send?

Follow-up Questions

How would you test that your middleware correctly rejects invalid tokens?
What security considerations would you keep in mind when storing the signing secret?
Can you explain how you would expose metrics for token verification failures?