JWT vs session strategy in NextJS - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding JWT vs Session Storage

Which of the following best describes a key difference between JWT and session-based authentication strategies in Next.js?

A Sessions are stateless and do not require server memory, JWTs always require server memory.

B JWT requires server-side storage for each user session, sessions do not.

C JWTs cannot be used for authentication in Next.js applications.

D JWT stores user data on the client side, while sessions store data on the server side.

💡 Hint

Think about where the user data is kept in each method.

JWTs store user information encoded in a token on the client side, so the server does not need to keep session data. Sessions keep user data on the server, linked by a session ID stored in a cookie.

❓ component_behavior

intermediate

Next.js API Route with JWT Authentication

Given a Next.js API route that verifies a JWT token from the Authorization header, what will happen if the token is missing or invalid?

NextJS

export default async function handler(req, res) {
  const authHeader = req.headers.authorization;
  if (!authHeader) {
    return res.status(401).json({ error: 'No token provided' });
  }
  const token = authHeader.split(' ')[1];
  try {
    const user = verifyToken(token); // throws if invalid
    res.status(200).json({ user });
  } catch {
    res.status(403).json({ error: 'Invalid token' });
  }
}

A Responds with 403 status and 'Invalid token' error if token is missing.

B Responds with 200 status and empty user object if token is missing.

C Responds with 401 status and 'No token provided' error if token is missing.

D Throws a server error and crashes the API route.

💡 Hint

Check the condition for missing token before verification.

If the Authorization header is missing, the code returns a 401 error with 'No token provided'. If the token is invalid, it returns 403 with 'Invalid token'.

❓ state_output

advanced

Session Storage Behavior in Next.js

In a Next.js app using session-based authentication, what will be the value of req.session.user after a user logs out?

NextJS

export default async function handler(req, res) {
  if (req.method === 'POST' && req.url === '/logout') {
    req.session.destroy();
    res.status(200).json({ message: 'Logged out' });
  } else {
    res.status(200).json({ user: req.session.user || null });
  }
}

A null, because the session is destroyed and user data is removed.

B An empty object {}, because the session remains but user data is cleared.

C The previous user object, because session destruction is asynchronous and not immediate.

D Undefined, because req.session is deleted entirely.

💡 Hint

Consider what happens to session data after calling destroy().

Calling req.session.destroy() removes the session and all its data, so req.session.user will be null or undefined after logout.

📝 Syntax

advanced

Correct JWT Verification Syntax in Next.js

Which option correctly verifies a JWT token using the jsonwebtoken library in a Next.js API route?

NextJS

import jwt from 'jsonwebtoken';

export default function handler(req, res) {
  const token = req.headers.authorization?.split(' ')[1];
  try {
    // Verify token here
  } catch (err) {
    res.status(401).json({ error: 'Unauthorized' });
  }
}

A const user = jwt.verify(token, process.env.JWT_SECRET);

B const user = jwt.decode(token, process.env.JWT_SECRET);

C const user = jwt.verify(token);

D const user = jwt.decode(token);

💡 Hint

Which method checks the token signature using a secret?

jwt.verify checks the token's signature using the secret key. jwt.decode only decodes without verifying.

🔧 Debug

expert

Debugging Token Expiry Handling in Next.js

A Next.js API route uses JWT for authentication. The code catches errors during verification but does not distinguish token expiry errors. What is the likely user experience when a token expires?

NextJS

try {
  const user = jwt.verify(token, process.env.JWT_SECRET);
  res.status(200).json({ user });
} catch (err) {
  res.status(401).json({ error: 'Unauthorized' });
}

A User is redirected to login automatically without error message.

B User always sees 'Unauthorized' error without knowing the token expired.

C User receives a specific 'Token expired' error message.

D The API route crashes due to unhandled token expiry error.

💡 Hint

Check how errors are handled in the catch block.

The catch block returns a generic 'Unauthorized' error for all verification failures, including expired tokens, so users do not get a specific expiry message.