JWT token generation and verification in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this JWT token verification code?

Consider this Node.js code using the jsonwebtoken library. What will be logged to the console?

Node.js

import jwt from 'jsonwebtoken';

const secret = 'mysecret';
const token = jwt.sign({ userId: 123 }, secret, { expiresIn: '1h' });

try {
  const decoded = jwt.verify(token, secret);
  console.log(decoded.userId);
} catch (err) {
  console.log('Invalid token');
}

A 123

B Invalid token

C SyntaxError

D undefined

💡 Hint

The token is signed and verified with the same secret and is not expired.

The token is correctly signed with the secret and verified immediately, so the payload is decoded and userId 123 is logged.

❓ component_behavior

intermediate

What happens if you verify a JWT token with the wrong secret?

Given this code snippet, what will be the console output?

Node.js

import jwt from 'jsonwebtoken';

const secret = 'correctsecret';
const wrongSecret = 'wrongsecret';
const token = jwt.sign({ role: 'admin' }, secret);

try {
  const decoded = jwt.verify(token, wrongSecret);
  console.log(decoded.role);
} catch (error) {
  console.log(error.name);
}

A TokenExpiredError

B admin

C undefined

D JsonWebTokenError

💡 Hint

The secret used to verify must match the secret used to sign.

Verifying a token with a different secret than the one used to sign it causes a JsonWebTokenError because the signature does not match.

📝 Syntax

advanced

Which option correctly generates a JWT token with an expiration of 2 hours?

Choose the code snippet that correctly creates a JWT token with a 2-hour expiration using jsonwebtoken.

A jwt.sign({ id: 1 }, 'secret', { expiration: 7200 })

B jwt.sign({ id: 1 }, 'secret', { expiresIn: '2h' })

C jwt.sign({ id: 1 }, 'secret', { expireIn: 2 })

D jwt.sign({ id: 1 }, 'secret', { expires: '2hours' })

💡 Hint

Check the exact option name and value format for expiration in jsonwebtoken.

The correct option uses the 'expiresIn' option with a string '2h' to set expiration to 2 hours. Other options use incorrect property names or formats.

🔧 Debug

advanced

Why does this JWT verification code throw an error?

Examine the code and select the reason for the error thrown during verification.

Node.js

import jwt from 'jsonwebtoken';

const secret = 'topsecret';
const token = jwt.sign({ name: 'Alice' }, secret);

const decoded = jwt.verify(token);
console.log(decoded.name);

A Missing secret argument in jwt.verify causes an error

B Token is expired

C Payload is empty

D jwt.sign syntax is incorrect

💡 Hint

jwt.verify requires the token and the secret to verify the signature.

jwt.verify requires both the token and the secret key to verify the token's signature. Omitting the secret causes an error.

🧠 Conceptual

expert

What is the main security risk if you expose your JWT secret key publicly?

Select the best explanation for the risk of exposing your JWT secret key.

A Users will lose their passwords

B Tokens will expire immediately

C Attackers can create valid tokens and impersonate users

D The server will reject all tokens

💡 Hint

Think about what the secret key is used for in JWT.

The secret key signs tokens. If attackers get it, they can create tokens that the server accepts as valid, allowing impersonation.