JWT integration in GraphQL - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does JWT stand for and what is its main purpose?

JWT stands for JSON Web Token. Its main purpose is to securely transmit information between parties as a JSON object, often used for authentication.

beginner

How is a JWT typically structured?

A JWT has three parts separated by dots: Header, Payload, and Signature. The Header describes the token type and algorithm, the Payload contains claims, and the Signature verifies the token's integrity.

beginner

In GraphQL, where is the JWT usually sent from the client to the server?

The JWT is usually sent in the HTTP Authorization header as a Bearer token when making GraphQL requests.

intermediate

What is the role of the JWT signature in integration?

The signature ensures the token was not altered and verifies the sender's identity by using a secret or public/private key pair.

intermediate

How can you verify a JWT in a GraphQL server resolver?

You decode the JWT from the Authorization header, verify its signature and expiration, then use the decoded data (like user ID) to control access or fetch user info.

What part of a JWT contains the user information or claims?

A Payload

B Header

C Signature

D Token type

The Payload contains the claims or user information in a JWT.

How is a JWT usually sent in a GraphQL request?

A In the HTTP Authorization header

B In the query string

C As a cookie only

D In the response body

JWTs are typically sent in the HTTP Authorization header as Bearer tokens.

What does the JWT signature protect against?

A Token expiration

B Token size limits

C Token encoding

D Token tampering

The signature ensures the token has not been tampered with.

Which algorithm is commonly used to sign JWTs?

A SHA-256

B RSA or HMAC

C MD5

D AES

JWTs are commonly signed using RSA or HMAC algorithms.

What should a GraphQL server do if a JWT is expired?

A Accept the token anyway

B Refresh the token automatically

C Reject the request and ask for re-authentication

D Ignore expiration and continue

Expired JWTs should be rejected and the user asked to re-authenticate.

Explain how JWT integration works in a GraphQL API from client request to server verification.

Think about the steps from sending the token to checking it on the server.

Describe the structure of a JWT and the role of each part in security.

Consider how each part helps keep the token safe and trustworthy.

Practice

1. What is the main purpose of using JWT in GraphQL database integration?

easy

A. To store large amounts of data

B. To speed up database queries

C. To verify the user's identity and secure database access

D. To format the GraphQL schema

Solution

1. Step 1: Understand JWT role in security

   JWT (JSON Web Token) is used to confirm who the user is by verifying their identity.

2. Step 2: Connect JWT to database access

   This verification controls who can access or change data in the GraphQL database.

3. Final Answer:

   To verify the user's identity and secure database access -> Option C

4. Quick Check:

   JWT secures access [OK]

Hint: JWT = user identity check for secure access [OK]

Common Mistakes:

• Thinking JWT speeds up queries
• Confusing JWT with data storage
• Assuming JWT changes schema format

2. Which is the correct way to send a JWT token in a GraphQL request header?

easy

A. Token: Authorization <token>

B. Authorization: Token <token>

C. Auth: Bearer <token>

D. Authorization: Bearer <token>

Solution

1. Step 1: Recall standard JWT header format

   The JWT token is sent in the HTTP header named 'Authorization' with the prefix 'Bearer'.

2. Step 2: Match the correct header syntax

   The correct syntax is 'Authorization: Bearer <token>'. Other options use wrong header names or order.

3. Final Answer:

   Authorization: Bearer <token> -> Option D

4. Quick Check:

   JWT header uses Bearer prefix [OK]

Hint: JWT always uses 'Authorization: Bearer <token>' header [OK]

Common Mistakes:

• Using 'Token' instead of 'Bearer'
• Wrong header name like 'Auth'
• Mixing order of 'Token' and 'Authorization'

3. Given this GraphQL resolver snippet using JWT:

const user = verifyToken(context.headers.authorization);
if (!user) return null;
return db.getUserData(user.id);

What happens if the token is invalid or missing?

medium

A. The resolver returns null and no data is fetched

B. The resolver throws a syntax error

C. The resolver returns all user data without restriction

D. The resolver crashes the server

Solution

1. Step 1: Analyze token verification

   The function verifyToken returns null or false if the token is invalid or missing.

2. Step 2: Check resolver behavior on invalid token

   If user is falsy, the resolver returns null, meaning no data is sent back.

3. Final Answer:

   The resolver returns null and no data is fetched -> Option A

4. Quick Check:

   Invalid token leads to null return [OK]

Hint: Invalid token means no user, so resolver returns null [OK]

Common Mistakes:

• Expecting a syntax error on invalid token
• Assuming data is returned without user
• Thinking server crashes on bad token

4. Identify the error in this JWT integration snippet:

const token = context.headers.Authorization;
const user = verifyToken(token);
if (!user) throw new Error('Unauthorized');
return db.getUserData(user.id);

medium

A. verifyToken should be called with context.token, not token

B. Header name should be lowercase 'authorization', not 'Authorization'

C. The error message should be 'Forbidden' instead of 'Unauthorized'

D. db.getUserData should be called before verifying the token

Solution

1. Step 1: Check header name case sensitivity

   HTTP headers in Node.js are usually lowercase, so 'authorization' is correct, not 'Authorization'.

2. Step 2: Confirm token extraction correctness

   Using 'Authorization' may cause token to be undefined, leading to verification failure.

3. Final Answer:

   Header name should be lowercase 'authorization', not 'Authorization' -> Option B

4. Quick Check:

   Header keys are lowercase [OK]

Hint: Use lowercase 'authorization' header key in code [OK]

Common Mistakes:

• Using uppercase header keys in Node.js
• Calling db before verifying user
• Confusing error message types

5. You want to restrict a GraphQL query so only users with role 'admin' can access sensitive data. Which JWT integration approach is best?

hard

A. Verify token, then check if user.role === 'admin' before returning data

B. Return data first, then verify token asynchronously

C. Skip token verification and rely on frontend checks

D. Verify token but ignore user roles for simplicity

Solution

1. Step 1: Understand role-based access control

   To restrict access, verify the token and check the user's role before sending data.

2. Step 2: Evaluate options for security

   Returning data before verification or skipping roles risks exposing sensitive info.

3. Final Answer:

   Verify token, then check if user.role === 'admin' before returning data -> Option A

4. Quick Check:

   Check role after token verification [OK]

Hint: Check user role after verifying JWT token [OK]

Common Mistakes:

• Sending data before verifying user
• Ignoring roles in backend checks
• Trusting frontend for security