JWT token creation in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this FastAPI JWT token creation snippet?

Consider this FastAPI code that creates a JWT token. What does the token variable contain after running this code?

FastAPI

from fastapi import FastAPI
from jose import jwt

app = FastAPI()

SECRET_KEY = "mysecret"
ALGORITHM = "HS256"

payload = {"sub": "user123"}
token = jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)

print(token)

A A string token encoded with HS256 containing the payload {"sub": "user123"}

B A dictionary with keys 'sub' and 'token'

C A bytes object representing the token

D An error because jose.jwt.encode requires a list payload

💡 Hint

Remember jwt.encode returns a string token, not a dictionary or bytes.

The jwt.encode function from jose returns a string JWT token encoded with the given algorithm and secret key. The payload is embedded inside the token.

📝 Syntax

intermediate

Which option correctly creates a JWT token with expiration in FastAPI?

You want to create a JWT token that expires in 30 minutes. Which code snippet correctly adds the expiration claim?

FastAPI

from datetime import datetime, timedelta
from jose import jwt

SECRET_KEY = "secret"
ALGORITHM = "HS256"

expire = datetime.utcnow() + timedelta(minutes=30)
payload = {"sub": "user1", "exp": expire.timestamp()}
token = jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)

A Use 'exp': expire.timestamp() in payload

B Use 'exp': expire in payload

C Use 'exp': str(expire) in payload

D Use 'exp': expire.isoformat() in payload

💡 Hint

JWT expects the 'exp' claim as a Unix timestamp (number), not a datetime object or string.

The 'exp' claim must be a Unix timestamp (seconds since epoch). Using expire.timestamp() converts datetime to float seconds, which is valid.

🔧 Debug

advanced

Why does this FastAPI JWT token creation code raise a TypeError?

Examine this code snippet. Why does it raise a TypeError when encoding the token? from jose import jwt payload = {"sub": "user1", "exp": 1680000000} secret = None token = jwt.encode(payload, secret, algorithm="HS256")

FastAPI

from jose import jwt

payload = {"sub": "user1", "exp": 1680000000}
secret = None

token = jwt.encode(payload, secret, algorithm="HS256")

A Because the algorithm 'HS256' is invalid

B Because the payload 'exp' value is an integer, it must be a string

C Because the secret key is None, jwt.encode expects a string or bytes

D Because the payload is missing the 'iat' claim

💡 Hint

Check the type of the secret key passed to jwt.encode.

jwt.encode requires the secret key to be a string or bytes. Passing None causes a TypeError.

❓ state_output

advanced

What is the value of 'decoded_payload' after decoding this JWT token?

Given this code, what does 'decoded_payload' contain? from jose import jwt SECRET_KEY = "key123" ALGORITHM = "HS256" payload = {"sub": "userX", "role": "admin"} token = jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM) decoded_payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])

FastAPI

from jose import jwt

SECRET_KEY = "key123"
ALGORITHM = "HS256"
payload = {"sub": "userX", "role": "admin"}
token = jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
decoded_payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])

A Raises a JWTError because decode requires expiration claim

B {"sub": "userX", "role": "admin", "alg": "HS256"}

C {"sub": "userX"}

D {"sub": "userX", "role": "admin"}

💡 Hint

jwt.decode returns the original payload if the token is valid and secret matches.

The decoded payload matches the original payload dictionary used to encode the token.

🧠 Conceptual

expert

Which statement about JWT token creation in FastAPI is true?

Select the correct statement about creating JWT tokens in FastAPI using the jose library.

A The secret key can be any Python object; jose.jwt.encode will convert it automatically.

B The 'exp' claim must be a Unix timestamp number; otherwise, token validation will fail.

C JWT tokens created with HS256 do not require a secret key for encoding.

D The payload dictionary keys must be strings starting with 'jwt_' to be valid.

💡 Hint

Think about the standard JWT claims and their expected formats.

JWT 'exp' claim must be a Unix timestamp number. Secret key must be a string or bytes. HS256 requires a secret key. Payload keys can be any strings.