JWT token creation in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does JWT stand for and what is its main purpose?

JWT stands for JSON Web Token. It is used to securely transmit information between parties as a JSON object, often for authentication.

beginner

Which npm package is commonly used in Express to create and verify JWT tokens?

The 'jsonwebtoken' package is commonly used to create and verify JWT tokens in Express applications.

beginner

What are the three parts of a JWT token?

A JWT token has three parts separated by dots: Header, Payload, and Signature.

intermediate

In Express, how do you create a JWT token with a payload containing a user ID and a secret key?

Use jsonwebtoken's sign method: jwt.sign({ userId: user.id }, 'your-secret-key', { expiresIn: '1h' })

beginner

Why should the secret key used to sign JWT tokens be kept safe?

Because anyone with the secret key can create valid tokens or decode sensitive information, risking security.

Which method from the 'jsonwebtoken' package creates a JWT token?

A jwt.create()

B jwt.verify()

C jwt.sign()

D jwt.decode()

jwt.sign() creates a new JWT token by signing a payload with a secret key.

What is the purpose of the 'expiresIn' option when creating a JWT token?

A To encrypt the token

B To verify the token

C To add user roles

D To set how long the token is valid

'expiresIn' sets the token's lifetime, after which it becomes invalid.

What does the payload of a JWT token usually contain?

A The secret key

B User data or claims

C The token signature

D The server IP address

The payload holds user information or claims to be shared securely.

Which part of the JWT token ensures it has not been tampered with?

A Signature

B Header

C Payload

D Issuer

The signature verifies the token's integrity and authenticity.

In Express, where should you store the secret key used for JWT signing?

A In environment variables

B In the client-side code

C In the public folder

D Hardcoded in the source code

Storing secrets in environment variables keeps them safe and out of source code.

Explain how to create a JWT token in an Express app including the key steps and important options.

Think about the function call and what information it needs.

Describe why JWT tokens are useful for authentication and what security practices should be followed.

Consider how tokens replace sessions and what risks exist.