JWT token creation in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this JWT token creation code?

Consider this Express route that creates a JWT token. What will be the response body when a POST request is made with {"userId": "123"}?

Express

import express from 'express';
import jwt from 'jsonwebtoken';

const app = express();
app.use(express.json());

app.post('/login', (req, res) => {
  const { userId } = req.body;
  const token = jwt.sign({ id: userId }, 'secretKey', { expiresIn: '1h' });
  res.json({ token });
});

A SyntaxError

B TypeError

C {"error": "Invalid userId"}

D {"token": "<a valid JWT token string>"}

💡 Hint

The jwt.sign method returns a string token when called correctly.

The code creates a JWT token with the userId in the payload and returns it as JSON. No errors occur if userId is provided.

📝 Syntax

intermediate

Which option correctly creates a JWT token with payload {id: 5} and secret 'key'?

Choose the code snippet that correctly creates a JWT token using jsonwebtoken in Express.

A jwt.sign(id: 5, 'key')

B jwt.sign({ id: 5 }, 'key')

C jwt.sign({id: 5}, key)

D jwt.sign({ id: 5 }, 'key', expiresIn: '1h')

💡 Hint

The payload must be an object, and the secret a string.

Option B correctly calls jwt.sign with payload object and secret string. Option B has wrong syntax. Option B uses undefined variable key. Option B has wrong options syntax.

🔧 Debug

advanced

What error does this JWT token creation code raise?

Analyze the code below. What error will occur when this Express route is called?

Express

app.post('/token', (req, res) => {
  const token = jwt.sign({ user: req.body.user });
  res.send(token);
});

A TypeError: secretOrPrivateKey must have a value

B SyntaxError: Unexpected token

C ReferenceError: jwt is not defined

D No error, returns a token string

💡 Hint

jwt.sign requires a secret string as second argument.

The code calls jwt.sign without the secret key argument, causing a TypeError.

❓ state_output

advanced

What is the value of 'decoded' after verifying this JWT token?

Given this code snippet, what will be the value of 'decoded' if the token is valid?

Express

const token = jwt.sign({ id: 10, role: 'admin' }, 'mySecret');
const decoded = jwt.verify(token, 'mySecret');

A SyntaxError

B { id: 10, role: 'admin' }

C { id: 10, role: 'admin', iat: <number> }

D null

💡 Hint

jwt.verify returns the payload plus issued at timestamp.

The decoded object includes the original payload plus an 'iat' field with the issued timestamp.

🧠 Conceptual

expert

Which option best explains why JWT tokens include a secret key during creation?

Why do we provide a secret key when creating a JWT token with jwt.sign?

A To sign the token so its integrity can be verified

B To encrypt the token so only the server can read it

C To store user data securely inside the token

D To make the token expire automatically

💡 Hint

Think about what signing a token means.

The secret key is used to sign the token, allowing verification that it was issued by the server and not altered.