JWT structure and flow in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of decoding the JWT payload?

Given this JWT token payload encoded in Base64Url:

eyJ1c2VyX2lkIjogMTIzLCJyb2xlIjogImFkbWluIn0

What is the decoded JSON payload?

A {"user_id": "123", "role": "admin"}

B {"user_id": 123, "role": "user"}

C {"userid": 123, "role": "admin"}

D {"user_id": 123, "role": "admin"}

💡 Hint

Base64Url decoding converts the string back to JSON. Pay attention to key names and value types.

The Base64Url string decodes to the JSON object with keys user_id as number 123 and role as string "admin".

🧠 Conceptual

intermediate

Which step in JWT flow verifies the token's integrity?

In the JWT authentication flow, which step ensures the token has not been tampered with?

A Server verifies the token signature using the secret key

B Client stores the token in local storage

C Server decodes the token payload to read user info

D Client sends the token in the Authorization header

💡 Hint

Think about how the server knows the token is authentic and unchanged.

The server uses the secret key to verify the token's signature, confirming it was issued by a trusted source and not altered.

🔧 Debug

advanced

Why does this JWT verification code fail?

Consider this Python code snippet verifying a JWT token:

import jwt

token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.invalidsignature'
secret = 'mysecret'

try:
    payload = jwt.decode(token, secret, algorithms=['HS256'])
    print('Valid token')
except jwt.InvalidSignatureError:
    print('Invalid signature')
except Exception as e:
    print('Error:', e)

What is the output when running this code?

A Error: Not enough segments

B Valid token

C Invalid signature

D Error: Decode error

💡 Hint

The token's signature part is clearly invalid. What exception does the library raise?

The token has three parts but the signature is incorrect, so jwt.decode raises InvalidSignatureError.

📝 Syntax

advanced

Which code correctly creates a JWT token with payload and secret?

Choose the correct Python code snippet that creates a JWT token with payload {"user": "alice"} and secret "key123" using HS256 algorithm.

A jwt.encode({"user": "alice"}, "key123", algorithm="HS256")

B jwt.encode("user=alice", "key123", algorithm="HS256")

C jwt.encode({user: "alice"}, "key123", algorithm="HS256")

D jwt.encode({"user": "alice"}, key="key123", algo="HS256")

💡 Hint

Check the function signature and argument names carefully.

The correct syntax uses a dictionary for payload, the secret as second argument, and algorithm keyword for algorithm name.

🚀 Application

expert

How many items are in the JWT payload after decoding this token?

Given this JWT token (header.payload.signature):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYm9iIiwiaWQiOjQ1LCJleHAiOjE2ODk0MjAwMDB9.somesignature

After decoding the payload, how many key-value pairs does it contain?

A 2

B 3

C 4

D 1

💡 Hint

Decode the payload part and count the keys.

The payload contains keys: user, id, and exp, so 3 pairs total.