TOPIC OVERVIEW

JWT/Security

JWTs are easy to use, but small security mistakes can turn them into a serious authentication problem.

20 QuestionsAdvancedHigh Priority ~14 min read

A JWT is only as secure as the way your application creates, stores, sends, and verifies it. Problems such as weak signing secrets, accepting unexpected algorithms, ignoring expiration, storing tokens unsafely, or putting sensitive information in the payload can create vulnerabilities.

JWT security also involves thinking about token theft and revocation. Short-lived access tokens, secure token storage, refresh-token rotation, HTTPS, strong cryptographic keys, and careful validation can reduce the impact if a token is compromised.

What you'll walk away knowing

Why JWT payloads should not contain secrets

How signing algorithms and keys affect token security

How token theft and XSS or CSRF risks affect storage decisions

How expiration, refresh tokens, rotation, and revocation improve security

1What attacks are possible against JWT implementations?ExpertHigh 2Why is storing JWT in localStorage considered risky?ExpertHigh 3What is the biggest drawback of JWT?ExpertHigh 4JWT is stateless. Then how do you logout users?ExpertHigh 5How would you implement refresh token rotation?ExpertHigh 6Why not make access tokens valid for 30 days?ExpertHigh 7Explain Access Token and Refresh Token architecture.ExpertHigh 8User role changes from Admin to User. JWT still says Admin. What do you do?ExpertHigh 9How would you revoke millions of JWTs instantly?ExpertHigh 10How do you revoke JWTs?ExpertHigh 11LocalStorage vs HttpOnly cookies?ExpertHigh 12RS256 vs HS256?ExpertHigh 13How do role changes propagate?ExpertHigh

All Topics