JWT integration in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of JWT in database access?

Imagine you want to securely access your database through a web app. What role does JWT play in this process?

A It encrypts the database data automatically without any extra configuration.

B It stores the entire database schema inside the token for quick access.

C It acts as a secure token to verify the user's identity and permissions before allowing database access.

D It replaces the database with a JSON file for faster queries.

💡 Hint

Think about how a token helps confirm who you are before you get access.

JWT (JSON Web Token) is used to securely transmit information about a user, including their identity and permissions. This helps the system decide if the user can access certain database resources.

❓ query_result

intermediate

What is the output of this GraphQL query with JWT authorization?

Given a GraphQL query that requests user data, and a valid JWT token with user role 'admin', what will be the result?

GraphQL

query {
  users {
    id
    name
    email
  }
}

// JWT token payload: {"role": "admin"}

A [{"id": "1", "name": "Alice", "email": "[e-mail]"}, {"id": "2", "name": "Bob", "email": "[e-mail]"}]

B Error: Unauthorized access - insufficient permissions

C []

D Error: Invalid JWT token

💡 Hint

Admins usually have full access to user data.

The JWT token shows the user has the 'admin' role, which grants permission to fetch all users. So the query returns the full list of users.

📝 Syntax

advanced

Identify the syntax error in this JWT verification snippet in GraphQL resolver

Look at this code snippet that verifies a JWT token in a GraphQL resolver. Which option correctly fixes the syntax error?

GraphQL

const jwt = require('jsonwebtoken');

function verifyToken(token) {
  try {
    const decoded = jwt.verify(token, 'secretKey')
    return decoded;
  } catch (error) {
    throw new Error('Invalid token')
  }
}

A Remove the return statement to fix syntax.

B Add a semicolon after jwt.verify(token, 'secretKey') to fix syntax: const decoded = jwt.verify(token, 'secretKey');

C Replace try-catch with if-else to fix syntax.

D Change 'secretKey' to secretKey without quotes to fix syntax.

💡 Hint

Check if all statements end properly.

JavaScript statements should end with semicolons to avoid syntax errors. Adding a semicolon after jwt.verify fixes the syntax.

❓ optimization

advanced

How to optimize JWT usage to reduce database load in GraphQL API?

You want to reduce database queries by using JWT in your GraphQL API. Which approach is best?

A Store the entire user profile in the JWT token to eliminate database queries.

B Use JWT only for login and query the database for every request to ensure fresh data.

C Encrypt the JWT token with the database password to speed up queries.

D Include user roles and permissions inside the JWT payload to avoid querying the database for each request.

💡 Hint

Think about what info in the token can help skip database checks.

Including roles and permissions in the JWT lets the API verify access without querying the database every time, improving performance.

🔧 Debug

expert

Why does this GraphQL query fail with 'Invalid token' error despite a valid JWT?

Given this GraphQL resolver code snippet, why does the query fail with 'Invalid token' error even though the JWT token is valid?

GraphQL

const jwt = require('jsonwebtoken');

function resolver(parent, args, context) {
  const token = context.headers.authorization;
  try {
    const decoded = jwt.verify(token, process.env.SECRET);
    return getDataForUser(decoded.userId);
  } catch (e) {
    throw new Error('Invalid token');
  }
}

// Environment variable SECRET is not set.

A The environment variable SECRET is missing, so jwt.verify fails to validate the token.

B The token is expired, causing jwt.verify to throw an error.

C The token is not passed in the authorization header.

D The getDataForUser function is undefined, causing the error.

💡 Hint

Check if the secret used to verify the token is properly set.

jwt.verify needs the secret key to validate the token. If the environment variable SECRET is missing, verification fails and throws an error.

Practice

1. What is the main purpose of using JWT in GraphQL database integration?

easy

A. To store large amounts of data

B. To speed up database queries

C. To verify the user's identity and secure database access

D. To format the GraphQL schema

Solution

1. Step 1: Understand JWT role in security

   JWT (JSON Web Token) is used to confirm who the user is by verifying their identity.

2. Step 2: Connect JWT to database access

   This verification controls who can access or change data in the GraphQL database.

3. Final Answer:

   To verify the user's identity and secure database access -> Option C

4. Quick Check:

   JWT secures access [OK]

Hint: JWT = user identity check for secure access [OK]

Common Mistakes:

• Thinking JWT speeds up queries
• Confusing JWT with data storage
• Assuming JWT changes schema format

2. Which is the correct way to send a JWT token in a GraphQL request header?

easy

A. Token: Authorization <token>

B. Authorization: Token <token>

C. Auth: Bearer <token>

D. Authorization: Bearer <token>

Solution

1. Step 1: Recall standard JWT header format

   The JWT token is sent in the HTTP header named 'Authorization' with the prefix 'Bearer'.

2. Step 2: Match the correct header syntax

   The correct syntax is 'Authorization: Bearer <token>'. Other options use wrong header names or order.

3. Final Answer:

   Authorization: Bearer <token> -> Option D

4. Quick Check:

   JWT header uses Bearer prefix [OK]

Hint: JWT always uses 'Authorization: Bearer <token>' header [OK]

Common Mistakes:

• Using 'Token' instead of 'Bearer'
• Wrong header name like 'Auth'
• Mixing order of 'Token' and 'Authorization'

3. Given this GraphQL resolver snippet using JWT:

const user = verifyToken(context.headers.authorization);
if (!user) return null;
return db.getUserData(user.id);

What happens if the token is invalid or missing?

medium

A. The resolver returns null and no data is fetched

B. The resolver throws a syntax error

C. The resolver returns all user data without restriction

D. The resolver crashes the server

Solution

1. Step 1: Analyze token verification

   The function verifyToken returns null or false if the token is invalid or missing.

2. Step 2: Check resolver behavior on invalid token

   If user is falsy, the resolver returns null, meaning no data is sent back.

3. Final Answer:

   The resolver returns null and no data is fetched -> Option A

4. Quick Check:

   Invalid token leads to null return [OK]

Hint: Invalid token means no user, so resolver returns null [OK]

Common Mistakes:

• Expecting a syntax error on invalid token
• Assuming data is returned without user
• Thinking server crashes on bad token

4. Identify the error in this JWT integration snippet:

const token = context.headers.Authorization;
const user = verifyToken(token);
if (!user) throw new Error('Unauthorized');
return db.getUserData(user.id);

medium

A. verifyToken should be called with context.token, not token

B. Header name should be lowercase 'authorization', not 'Authorization'

C. The error message should be 'Forbidden' instead of 'Unauthorized'

D. db.getUserData should be called before verifying the token

Solution

1. Step 1: Check header name case sensitivity

   HTTP headers in Node.js are usually lowercase, so 'authorization' is correct, not 'Authorization'.

2. Step 2: Confirm token extraction correctness

   Using 'Authorization' may cause token to be undefined, leading to verification failure.

3. Final Answer:

   Header name should be lowercase 'authorization', not 'Authorization' -> Option B

4. Quick Check:

   Header keys are lowercase [OK]

Hint: Use lowercase 'authorization' header key in code [OK]

Common Mistakes:

• Using uppercase header keys in Node.js
• Calling db before verifying user
• Confusing error message types

5. You want to restrict a GraphQL query so only users with role 'admin' can access sensitive data. Which JWT integration approach is best?

hard

A. Verify token, then check if user.role === 'admin' before returning data

B. Return data first, then verify token asynchronously

C. Skip token verification and rely on frontend checks

D. Verify token but ignore user roles for simplicity

Solution

1. Step 1: Understand role-based access control

   To restrict access, verify the token and check the user's role before sending data.

2. Step 2: Evaluate options for security

   Returning data before verification or skipping roles risks exposing sensitive info.

3. Final Answer:

   Verify token, then check if user.role === 'admin' before returning data -> Option A

4. Quick Check:

   Check role after token verification [OK]

Hint: Check user role after verifying JWT token [OK]

Common Mistakes:

• Sending data before verifying user
• Ignoring roles in backend checks
• Trusting frontend for security