JWT token creation in Express - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the JWT library.

Express

const jwt = require('[1]');

Drag options to blanks, or click blank then click option'

Ajsonwebtoken

Bexpress

Cbody-parser

Dcors

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'express' instead of 'jsonwebtoken' for JWT handling.

Forgetting to install the 'jsonwebtoken' package.

The jsonwebtoken package is used to create and verify JWT tokens in Express.

2fill in blank

medium

Complete the code to create a JWT token with a payload.

Express

const token = jwt.sign({ userId: 123 }, '[1]');

Drag options to blanks, or click blank then click option'

Aexpress

Bmysecretkey

C12345

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using a public or guessable string as the secret.

Passing the payload as the secret key.

The second argument to jwt.sign is the secret key used to sign the token.

3fill in blank

hard

Fix the error in the code to set token expiration to 1 hour.

Express

const token = jwt.sign({ userId: 123 }, 'mysecretkey', { [1]: '1h' });

Drag options to blanks, or click blank then click option'

Atimeout

Bexpire

Cduration

DexpiresIn

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'expire' or 'timeout' instead of 'expiresIn'.

Passing expiration as part of the payload instead of options.

The correct option to set token expiration is expiresIn.

4fill in blank

hard

Fill both blanks to verify a JWT token and extract the payload.

Express

jwt.[1](token, 'mysecretkey', (err, [2]) => {
  if (err) {
    console.error('Invalid token');
  } else {
    console.log([2]);
  }
});

Drag options to blanks, or click blank then click option'

Averify

Bdecode

Cpayload

Ddata

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'decode' instead of 'verify' to check token validity.

Naming the decoded payload as 'payload' instead of 'data' (both work but only one is correct here).

Use jwt.verify to check the token and the callback receives the decoded data, often named data.

5fill in blank

hard

Fill all three blanks to create a JWT token with user info, secret, and expiration.

Express

const token = jwt.sign({ [1]: 'alice' }, '[2]', { [3]: '2h' });

Drag options to blanks, or click blank then click option'

Ausername

Bsupersecret

CexpiresIn

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' instead of 'username' as payload key.

Using wrong option name for expiration.

Using a weak or empty secret.

The payload key is 'username', the secret is 'supersecret', and the expiration option is 'expiresIn'.

Practice

1. What is the main purpose of creating a JWT token in an Express app?

easy

A. To connect to a database

B. To style the user interface

C. To handle file uploads

D. To securely store user information for authentication

Solution

1. Step 1: Understand JWT token role

   JWT tokens are used to safely store user data for verifying identity.

2. Step 2: Identify correct purpose

   Among the options, only storing user info for authentication matches JWT's role.

3. Final Answer:

   To securely store user information for authentication -> Option D

4. Quick Check:

   JWT purpose = Authentication [OK]

Hint: JWT tokens are for authentication, not UI or database [OK]

Common Mistakes:

• Confusing JWT with UI styling or database connection
• Thinking JWT handles file uploads

2. Which of the following is the correct syntax to create a JWT token using the jsonwebtoken package in Express?

easy

A. jwt.generate(payload, secretKey, { expiresIn: '1h' })

B. jwt.create(payload, secretKey, { expiresIn: '1h' })

C. jwt.sign(payload, secretKey, { expiresIn: '1h' })

D. jwt.make(payload, secretKey, { expiresIn: '1h' })

Solution

1. Step 1: Recall jsonwebtoken method

   The correct method to create a token is jwt.sign()

2. Step 2: Match syntax with options

   Only jwt.sign(payload, secretKey, { expiresIn: '1h' }) uses jwt.sign() with payload, secretKey, and expiresIn correctly.

3. Final Answer:

   jwt.sign(payload, secretKey, { expiresIn: '1h' }) -> Option C

4. Quick Check:

   Token creation method = sign() [OK]

Hint: Remember: jsonwebtoken uses sign() to create tokens [OK]

Common Mistakes:

• Using incorrect method names like create or generate
• Omitting the expiresIn option or using wrong syntax

3. Given the code snippet:

const jwt = require('jsonwebtoken');
const token = jwt.sign({ userId: 123 }, 'secret', { expiresIn: '2h' });
console.log(typeof token);

What will be the output when this code runs?

medium

A. 'object'

B. 'string'

C. 'undefined'

D. 'number'

Solution

1. Step 1: Understand jwt.sign output type

   jwt.sign returns a JWT token as a string.

2. Step 2: Check typeof token

   Using typeof on the token returns 'string'.

3. Final Answer:

   'string' -> Option B

4. Quick Check:

   jwt.sign() output type = string [OK]

Hint: jwt.sign() returns a token string, not an object [OK]

Common Mistakes:

• Assuming the token is an object
• Expecting undefined or number type

4. Identify the error in this JWT token creation code:

const jwt = require('jsonwebtoken');
const token = jwt.sign({ id: 1 }, 12345, { expiresIn: '1h' });

medium

A. Secret key should be a string, not a number

B. Payload must be a string, not an object

C. expiresIn option is invalid

D. jwt.sign requires a callback function

Solution

1. Step 1: Check secret key type

   The secret key must be a string for signing the token securely.

2. Step 2: Identify error in code

   The code uses 12345 (a number) as secret key, which is incorrect.

3. Final Answer:

   Secret key should be a string, not a number -> Option A

4. Quick Check:

   Secret key type = string [OK]

Hint: Secret key must always be a string for jwt.sign() [OK]

Common Mistakes:

• Passing number instead of string as secret key
• Thinking payload must be string
• Believing expiresIn is invalid
• Assuming callback is mandatory

5. You want to create a JWT token that expires in 30 minutes and includes the user's email and role. Which code snippet correctly achieves this in Express?

hard

A. jwt.sign({ email: user.email, role: user.role }, 'mySecret', { expiresIn: '30m' })

B. jwt.sign({ email: user.email, role: user.role }, 'mySecret', { expiresAt: '30m' })

C. jwt.sign({ email: user.email, role: user.role }, 'mySecret', { expireIn: 1800 })

D. jwt.sign({ email: user.email, role: user.role }, 'mySecret', { expiresIn: 30 })

Solution

1. Step 1: Include correct payload fields

   The payload must include email and role from user object.

2. Step 2: Use correct expiresIn format

   expiresIn accepts string like '30m' for 30 minutes; number means seconds but must be a number type without quotes.

3. Step 3: Identify correct option

   Check each: expiresAt is invalid key; expireIn is misspelled; expiresIn: 30 is only 30 seconds. Only jwt.sign({ email: user.email, role: user.role }, 'mySecret', { expiresIn: '30m' }) is correct.

4. Final Answer:

   jwt.sign({ email: user.email, role: user.role }, 'mySecret', { expiresIn: '30m' }) -> Option A

5. Quick Check:

   expiresIn '30m' string format = correct [OK]

Hint: Use expiresIn with string like '30m' for minutes [OK]

Common Mistakes:

• Using expiresAt instead of expiresIn
• Using small numbers like 30 for expiresIn (30 seconds, not minutes)
• Confusing expireIn with expiresIn