JWT token propagation in Microservices - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of JWT token propagation in microservices?

In a microservices architecture, why do services propagate JWT tokens between them?

A To maintain user identity and authorization context across service calls

B To encrypt all data transmitted between services

C To store session data on the server side

D To replace the need for HTTPS communication

💡 Hint

Think about how services know who the user is without re-authenticating.

JWT token propagation allows each microservice to verify the user's identity and permissions without querying a central session store, enabling stateless authentication.

❓ Architecture

intermediate

Which component is responsible for issuing JWT tokens in a microservices system?

In a typical microservices setup using JWT, which component usually creates and signs the JWT token?

A Database server

B API Gateway or Authentication Service

C Each individual microservice

D Load balancer

💡 Hint

Consider where user login and token creation logically happen.

The API Gateway or a dedicated Authentication Service handles user login and issues JWT tokens, which are then used by other services.

❓ scaling

advanced

How does JWT token propagation help scale microservices authentication?

Why does using JWT tokens for authentication improve scalability in microservices compared to centralized session storage?

A Because JWT tokens automatically refresh themselves without server interaction

B Because JWT tokens reduce network latency by compressing data

C Because JWT tokens are stateless and do not require centralized session lookups

D Because JWT tokens store user passwords securely

💡 Hint

Think about what happens when many services need to check user identity simultaneously.

JWT tokens contain all necessary user info and are verified locally by each service, eliminating the need for a central session store and reducing bottlenecks.

❓ tradeoff

advanced

What is a key tradeoff when using JWT token propagation for authorization in microservices?

Which of the following is a significant tradeoff when relying on JWT tokens for authorization across microservices?

A Difficulty in revoking tokens before expiration

B Increased network bandwidth due to token size

C Need for synchronous database calls on every request

D Requirement to store tokens in a centralized cache

💡 Hint

Consider what happens if a user’s permissions change or they log out.

JWT tokens are self-contained and valid until expiry, so revoking them early is challenging without additional infrastructure like token blacklists.

❓ component

expert

In a microservices system, which step correctly describes JWT token propagation during a user request flow?

Consider a user making a request that passes through multiple microservices. Which sequence correctly shows how JWT tokens are propagated?

A Client sends credentials → Each microservice generates its own JWT → Services exchange tokens

B Client sends JWT → Each microservice requests token from Authentication Service → Services verify token

C Client sends JWT → API Gateway strips token → Microservices request token from database

D Client sends JWT → API Gateway verifies and forwards JWT → Each microservice verifies JWT locally

💡 Hint

Think about how tokens are passed and verified without extra calls.

The client sends the JWT token with the request. The API Gateway verifies it and forwards it. Each microservice then verifies the token locally without extra network calls.