JWT integration in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of JWT in database access?

Imagine you want to securely access your database through a web app. What role does JWT play in this process?

A It encrypts the database data automatically without any extra configuration.

B It stores the entire database schema inside the token for quick access.

C It acts as a secure token to verify the user's identity and permissions before allowing database access.

D It replaces the database with a JSON file for faster queries.

💡 Hint

Think about how a token helps confirm who you are before you get access.

JWT (JSON Web Token) is used to securely transmit information about a user, including their identity and permissions. This helps the system decide if the user can access certain database resources.

❓ query_result

intermediate

What is the output of this GraphQL query with JWT authorization?

Given a GraphQL query that requests user data, and a valid JWT token with user role 'admin', what will be the result?

GraphQL

query {
  users {
    id
    name
    email
  }
}

// JWT token payload: {"role": "admin"}

A [{"id": "1", "name": "Alice", "email": "[e-mail]"}, {"id": "2", "name": "Bob", "email": "[e-mail]"}]

B Error: Unauthorized access - insufficient permissions

C []

D Error: Invalid JWT token

💡 Hint

Admins usually have full access to user data.

The JWT token shows the user has the 'admin' role, which grants permission to fetch all users. So the query returns the full list of users.

📝 Syntax

advanced

Identify the syntax error in this JWT verification snippet in GraphQL resolver

Look at this code snippet that verifies a JWT token in a GraphQL resolver. Which option correctly fixes the syntax error?

GraphQL

const jwt = require('jsonwebtoken');

function verifyToken(token) {
  try {
    const decoded = jwt.verify(token, 'secretKey')
    return decoded;
  } catch (error) {
    throw new Error('Invalid token')
  }
}

A Remove the return statement to fix syntax.

B Add a semicolon after jwt.verify(token, 'secretKey') to fix syntax: const decoded = jwt.verify(token, 'secretKey');

C Replace try-catch with if-else to fix syntax.

D Change 'secretKey' to secretKey without quotes to fix syntax.

💡 Hint

Check if all statements end properly.

JavaScript statements should end with semicolons to avoid syntax errors. Adding a semicolon after jwt.verify fixes the syntax.

❓ optimization

advanced

How to optimize JWT usage to reduce database load in GraphQL API?

You want to reduce database queries by using JWT in your GraphQL API. Which approach is best?

A Store the entire user profile in the JWT token to eliminate database queries.

B Use JWT only for login and query the database for every request to ensure fresh data.

C Encrypt the JWT token with the database password to speed up queries.

D Include user roles and permissions inside the JWT payload to avoid querying the database for each request.

💡 Hint

Think about what info in the token can help skip database checks.

Including roles and permissions in the JWT lets the API verify access without querying the database every time, improving performance.

🔧 Debug

expert

Why does this GraphQL query fail with 'Invalid token' error despite a valid JWT?

Given this GraphQL resolver code snippet, why does the query fail with 'Invalid token' error even though the JWT token is valid?

GraphQL

const jwt = require('jsonwebtoken');

function resolver(parent, args, context) {
  const token = context.headers.authorization;
  try {
    const decoded = jwt.verify(token, process.env.SECRET);
    return getDataForUser(decoded.userId);
  } catch (e) {
    throw new Error('Invalid token');
  }
}

// Environment variable SECRET is not set.

A The environment variable SECRET is missing, so jwt.verify fails to validate the token.

B The token is expired, causing jwt.verify to throw an error.

C The token is not passed in the authorization header.

D The getDataForUser function is undefined, causing the error.

💡 Hint

Check if the secret used to verify the token is properly set.

jwt.verify needs the secret key to validate the token. If the environment variable SECRET is missing, verification fails and throws an error.