Questions
12 of 13
1What attacks are possible against JWT implementations?
2Why is storing JWT in localStorage considered risky?
3What is the biggest drawback of JWT?
4JWT is stateless. Then how do you logout users?
5How would you implement refresh token rotation?
6Why not make access tokens valid for 30 days?
7Explain Access Token and Refresh Token architecture.
8User role changes from Admin to User. JWT still says Admin. What do you do?
9How would you revoke millions of JWTs instantly?
10How do you revoke JWTs?
11LocalStorage vs HttpOnly cookies?
12RS256 vs HS256?
13How do role changes propagate?
JWTJWT
Basics
Structure
Claims
Security
Implementations
Microservices
12 / 13

RS256 vs HS256?

RS256 uses asymmetric keys (private + public) for signing, ideal for distributed systems; HS256 uses a shared secret, simpler but less secure for multi-service environments.

HS256 (HMAC with SHA-256) uses a single secret key to both sign and verify tokens. It is fast and simple, but the secret must be shared among all services that validate tokens. If the secret is compromised, an attacker can forge tokens. RS256 (RSA with SHA-256) uses a private key to sign tokens and a public key to verify them. This allows the authentication server to keep the private key secret, while any service can obtain the public key (e.g., via JWKS). RS256 is the preferred choice for microservices because it enables secure key distribution without sharing sensitive secrets.

Key Differences
  1. 1

    HS256: Symmetric, single secret, faster, risk of secret leakage, harder to rotate.

  2. 2

    RS256: Asymmetric, public/private key pair, safer for microservices, supports key rotation via JWKS.

  3. 3

    Recommendation: Use RS256 in production microservices; HS256 is acceptable for internal, trusted services.