JWT integration in GraphQL - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does JWT stand for and what is its main purpose?

JWT stands for JSON Web Token. Its main purpose is to securely transmit information between parties as a JSON object, often used for authentication.

beginner

How is a JWT typically structured?

A JWT has three parts separated by dots: Header, Payload, and Signature. The Header describes the token type and algorithm, the Payload contains claims, and the Signature verifies the token's integrity.

beginner

In GraphQL, where is the JWT usually sent from the client to the server?

The JWT is usually sent in the HTTP Authorization header as a Bearer token when making GraphQL requests.

intermediate

What is the role of the JWT signature in integration?

The signature ensures the token was not altered and verifies the sender's identity by using a secret or public/private key pair.

intermediate

How can you verify a JWT in a GraphQL server resolver?

You decode the JWT from the Authorization header, verify its signature and expiration, then use the decoded data (like user ID) to control access or fetch user info.

What part of a JWT contains the user information or claims?

A Payload

B Header

C Signature

D Token type

The Payload contains the claims or user information in a JWT.

How is a JWT usually sent in a GraphQL request?

A In the HTTP Authorization header

B In the query string

C As a cookie only

D In the response body

JWTs are typically sent in the HTTP Authorization header as Bearer tokens.

What does the JWT signature protect against?

A Token expiration

B Token size limits

C Token encoding

D Token tampering

The signature ensures the token has not been tampered with.

Which algorithm is commonly used to sign JWTs?

A SHA-256

B RSA or HMAC

C MD5

D AES

JWTs are commonly signed using RSA or HMAC algorithms.

What should a GraphQL server do if a JWT is expired?

A Accept the token anyway

B Refresh the token automatically

C Reject the request and ask for re-authentication

D Ignore expiration and continue

Expired JWTs should be rejected and the user asked to re-authenticate.

Explain how JWT integration works in a GraphQL API from client request to server verification.

Think about the steps from sending the token to checking it on the server.

Describe the structure of a JWT and the role of each part in security.

Consider how each part helps keep the token safe and trustworthy.