JWT token verification middleware in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does this JWT verification middleware do?

Consider this Express middleware that verifies a JWT token from the request header. What will happen if the token is missing?

Express

import jwt from 'jsonwebtoken';

const verifyToken = (req, res, next) => {
  const token = req.headers['authorization'];
  if (!token) {
    return res.status(401).json({ message: 'No token provided' });
  }
  jwt.verify(token, 'secretkey', (err, decoded) => {
    if (err) {
      return res.status(403).json({ message: 'Failed to authenticate token' });
    }
    req.userId = decoded.id;
    next();
  });
};

export default verifyToken;

A The middleware throws an error and crashes the server.

B The middleware calls next() without any checks and allows the request to continue.

C The middleware sends a 403 response with message 'Failed to authenticate token' immediately.

D The middleware sends a 401 response with message 'No token provided' and stops further processing.

💡 Hint

Think about what happens when the token is not found in the headers.

If the token is missing, the middleware returns a 401 status and a message, stopping the request from continuing.

📝 Syntax

intermediate

Which option correctly verifies a JWT token asynchronously?

Choose the code snippet that correctly verifies a JWT token using the jsonwebtoken library in Express middleware.

A jwt.verify(token, 'secretkey', (err, decoded) => { if (err) return res.status(403).send('Invalid token'); req.user = decoded; next(); });

B const decoded = jwt.verify(token, 'secretkey'); req.user = decoded; next();

C jwt.verify(token, 'secretkey', (decoded, err) => { if (err) return res.status(403).send('Invalid token'); req.user = decoded; next(); });

D jwt.verify(token, (err, decoded) => { if (err) return res.status(403).send('Invalid token'); req.user = decoded; next(); });

💡 Hint

Remember the order of parameters in the callback for jwt.verify.

The callback receives err first, then decoded. Option A uses the correct order and parameters.

🔧 Debug

advanced

Why does this JWT middleware crash the server?

Look at this middleware code. Why does it crash the server when an invalid token is sent?

Express

import jwt from 'jsonwebtoken';

const verifyToken = (req, res, next) => {
  const token = req.headers['authorization'];
  const decoded = jwt.verify(token, 'secretkey');
  req.userId = decoded.id;
  next();
};

export default verifyToken;

A Because next() is called before jwt.verify completes.

B Because the token is missing and the code does not check for it.

C Because jwt.verify throws an error on invalid token and it is not caught, crashing the server.

D Because the secret key is incorrect.

💡 Hint

Think about what happens when jwt.verify fails without a try-catch.

jwt.verify throws an error if the token is invalid. Without a try-catch, this error crashes the server.

❓ state_output

advanced

What is the value of req.userId after this middleware runs with a valid token?

Given this middleware and a valid JWT token with payload { id: 42 }, what will req.userId be?

Express

import jwt from 'jsonwebtoken';

const verifyToken = (req, res, next) => {
  const token = req.headers['authorization'];
  jwt.verify(token, 'secretkey', (err, decoded) => {
    if (err) {
      return res.status(403).json({ message: 'Invalid token' });
    }
    req.userId = decoded.id;
    next();
  });
};

export default verifyToken;

A 42

B undefined

C null

D Throws an error

💡 Hint

Check how the decoded token payload is assigned to req.userId.

The decoded token contains { id: 42 }, so req.userId is set to 42.

🧠 Conceptual

expert

Why is it important to call next() only after successful JWT verification?

In Express middleware for JWT verification, why should next() be called only after the token is verified successfully?

A To improve server performance by skipping token verification for all requests.

B To prevent unauthorized requests from reaching protected routes by stopping the request early.

C To allow all requests to pass through regardless of token validity.

D To automatically refresh the JWT token for the user.

💡 Hint

Think about security and what happens if next() is called too early.

Calling next() only after verification ensures only authorized users access protected routes.