Authentication with JWT token in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a JWT token in the context of authentication?

A JWT (JSON Web Token) is a compact, URL-safe token used to securely transmit information between parties. It contains claims and is digitally signed to verify authenticity, often used to prove user identity after login.

beginner

What are the three parts of a JWT token?

A JWT token has three parts separated by dots: Header (specifies token type and signing algorithm), Payload (contains claims like user info), and Signature (verifies token integrity).

intermediate

How does Spring Boot typically verify a JWT token in a request?

Spring Boot extracts the JWT from the Authorization header, verifies its signature and expiration, then loads user details from the token claims to authenticate the user for the request.

intermediate

Why is it important to keep the JWT secret key safe?

The secret key signs the JWT token. If exposed, attackers can create fake tokens and impersonate users, breaking security. Keeping it secret ensures token trustworthiness.

beginner

What is the role of the 'Authorization' header in JWT authentication?

The 'Authorization' header carries the JWT token in the format 'Bearer <token>'. It is sent with each request to prove the user's identity to the server.

Which part of the JWT contains the user's identity information?

A Header

B Secret key

C Signature

D Payload

The Payload part contains claims including user identity details.

In Spring Boot, where is the JWT token usually found in an HTTP request?

A In a cookie

B In the Authorization header

C In the request body

D In the URL query parameters

JWT tokens are typically sent in the Authorization header as 'Bearer '.

What does the signature part of a JWT ensure?

A That the token has not been tampered with

B That the token is encrypted

C That the token is expired

D That the token contains user roles

The signature verifies the token's integrity and authenticity.

Why should the JWT secret key never be exposed publicly?

A Because it can be used to generate fake tokens

B Because it is stored in the database

C Because it slows down the server

D Because it contains user passwords

Exposing the secret key allows attackers to create valid fake tokens.

What happens if a JWT token is expired when received by the server?

A The server accepts it anyway

B The server refreshes the token automatically

C The server rejects the request and asks for re-authentication

D The server ignores the expiration

Expired tokens are rejected to maintain security; users must log in again.

Explain how JWT authentication works in a Spring Boot application from login to accessing a protected resource.

Think about the steps from user login to token verification on requests.

Describe the structure of a JWT token and the purpose of each part.

Remember the token has three dot-separated parts.