Authentication with JWT token in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to generate a JWT token using the secret key.

Spring Boot

String token = Jwts.builder().setSubject(username).signWith([1]).compact();

Drag options to blanks, or click blank then click option'

AKeys.hmacShaKeyFor(secret.getBytes())

Bnew SecretKeySpec(secret.getBytes(), "HmacSHA256")

CMac.getInstance("HmacSHA256")

DSecretKeyFactory.getInstance("PBKDF2WithHmacSHA256")

Attempts:

3 left

💡 Hint

Common Mistakes

Using Mac or SecretKeyFactory directly instead of Keys utility.

Passing raw secret string instead of a Key object.

The signWith method requires a Key object. Using Keys.hmacShaKeyFor(secret.getBytes()) correctly creates the key for signing the JWT.

2fill in blank

medium

Complete the code to extract the username from the JWT token.

Spring Boot

String username = Jwts.parserBuilder().setSigningKey([1]).build().parseClaimsJws(token).getBody().getSubject();

Drag options to blanks, or click blank then click option'

AKeys.hmacShaKeyFor(secret.getBytes())

Bsecret

Ctoken

Dnew SecretKeySpec(secret.getBytes(), "HmacSHA256")

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the raw secret string instead of a Key object.

Passing the token string as the key.

The parser needs the signing key as a Key object to verify the token signature. Using Keys.hmacShaKeyFor(secret.getBytes()) provides the correct key.

3fill in blank

hard

Fix the error in the code that validates the JWT token expiration.

Spring Boot

boolean isValid = !Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token).getBody().getExpiration().[1](new Date());

Drag options to blanks, or click blank then click option'

AcompareTo

Bafter

Cequals

Dbefore

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'after' without negation causes wrong validation.

Using 'equals' or 'compareTo' incorrectly.

The token is valid if its expiration date is after the current date. Using before checks if expiration is before now, so negating it means valid if expiration is in the future.

4fill in blank

hard

Fill both blanks to create a JWT token with expiration time set to 1 hour from now.

Spring Boot

String token = Jwts.builder().setSubject(user).setExpiration(new Date(System.currentTimeMillis() [1] [2])).signWith(key).compact();

Drag options to blanks, or click blank then click option'

A+

B*

C-

D/

Attempts:

3 left

💡 Hint

Common Mistakes

Using subtraction instead of addition.

Using division or wrong operators.

To set expiration 1 hour from now, add 1 hour in milliseconds to current time. 1 hour = 60 * 60 * 1000 ms, so use System.currentTimeMillis() + 60 * 60 * 1000.

5fill in blank

hard

Fill all three blanks to parse the JWT token, extract claims, and get the 'roles' claim as a list.

Spring Boot

Claims claims = Jwts.parserBuilder().setSigningKey([1]).build().parseClaimsJws(token).getBody(); List<String> roles = claims.get([2], [3]);

Drag options to blanks, or click blank then click option'

Akey

B"roles"

CList.class

DString.class

Attempts:

3 left

💡 Hint

Common Mistakes

Using String.class instead of List.class for roles.

Passing raw secret string instead of key.

The signing key is needed to parse the token. The 'roles' claim is extracted by its name as a List, so use claims.get("roles", List.class).

Practice

1. What is the main purpose of using a JWT token in Spring Boot authentication?

easy

A. To store user passwords in the database

B. To securely transmit user identity without sending passwords every time

C. To encrypt the entire application data

D. To replace the need for HTTPS

Solution

1. Step 1: Understand JWT token role

   JWT tokens are used to prove user identity securely without resending passwords.

2. Step 2: Compare options with JWT purpose

   Only To securely transmit user identity without sending passwords every time correctly describes this purpose; others are unrelated or incorrect.

3. Final Answer:

   To securely transmit user identity without sending passwords every time -> Option B

4. Quick Check:

   JWT token purpose = secure identity proof [OK]

Hint: JWT tokens prove identity without passwords [OK]

Common Mistakes:

• Thinking JWT stores passwords
• Confusing JWT with data encryption
• Assuming JWT replaces HTTPS

2. Which of the following is the correct way to extract the JWT token from an HTTP request header in Spring Boot?

easy

A. String token = request.getParameter("Authorization");

B. String token = request.getCookie("jwt");

C. String token = request.getBody();

D. String token = request.getHeader("Authorization").substring(7);

Solution

1. Step 1: Identify JWT token location in HTTP request

   JWT tokens are usually sent in the Authorization header with prefix "Bearer ".

2. Step 2: Extract token correctly

   String token = request.getHeader("Authorization").substring(7); extracts the header and removes the "Bearer " prefix (7 characters), which is correct.

3. Final Answer:

   String token = request.getHeader("Authorization").substring(7); -> Option D

4. Quick Check:

   Extract JWT from Authorization header [OK]

Hint: JWT is in Authorization header with 'Bearer ' prefix [OK]

Common Mistakes:

• Using request parameters instead of headers
• Trying to get token from request body
• Assuming token is in cookies by default

3. Given this Spring Boot JWT validation snippet, what will be the output if the token is expired?

try {
  Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token);
  System.out.println("Token is valid");
} catch (ExpiredJwtException e) {
  System.out.println("Token expired");
} catch (JwtException e) {
  System.out.println("Invalid token");
}

medium

A. Invalid token

B. Token is valid

C. Token expired

D. No output

Solution

1. Step 1: Understand exception handling in JWT parsing

   If the token is expired, the parser throws ExpiredJwtException, caught by the first catch block.

2. Step 2: Identify printed output for expired token

   The catch block prints "Token expired" when ExpiredJwtException occurs.

3. Final Answer:

   Token expired -> Option C

4. Quick Check:

   Expired token triggers ExpiredJwtException [OK]

Hint: ExpiredJwtException means token expired [OK]

Common Mistakes:

• Confusing expired token with invalid token
• Ignoring exception handling order
• Assuming no output on exceptions

4. Identify the error in this JWT token generation code snippet in Spring Boot:

String token = Jwts.builder()
  .setSubject(username)
  .signWith(SignatureAlgorithm.HS256, secretKey)
  .compact();

medium

A. Incorrect method to set signing key in new jjwt versions

B. Missing call to build() before compact()

C. Username should not be set as subject

D. Missing token expiration setting

Solution

1. Step 1: Check jjwt signing method usage

   In recent jjwt versions, signWith requires a Key object, not just algorithm and string key.

2. Step 2: Identify correct signing method

   Using signWith(SignatureAlgorithm, String) is deprecated and causes errors; must use signWith(Key).

3. Final Answer:

   Incorrect method to set signing key in new jjwt versions -> Option A

4. Quick Check:

   Use Key object with signWith in jjwt [OK]

Hint: Use Key object, not algorithm + string, in signWith [OK]

Common Mistakes:

• Ignoring jjwt version changes
• Assuming string key is accepted directly
• Confusing expiration with signing errors

5. You want to implement JWT authentication in Spring Boot that automatically rejects tokens older than 15 minutes and refreshes tokens on each valid request. Which approach correctly combines expiration and refresh logic?

hard

A. Set token expiration to 15 minutes and issue a new token with updated expiration on each valid request

B. Set token expiration to 15 minutes and never refresh tokens; force user to login again after expiry

C. Set token expiration to 1 hour and refresh tokens only when user logs out

D. Do not set expiration and refresh tokens every time to keep user logged in indefinitely

Solution

1. Step 1: Understand token expiration and refresh needs

   To reject tokens older than 15 minutes, set expiration to 15 minutes.

2. Step 2: Implement refresh on each valid request

   Issuing a new token with updated expiration on each valid request keeps user session active securely.

3. Final Answer:

   Set token expiration to 15 minutes and issue a new token with updated expiration on each valid request -> Option A

4. Quick Check:

   Short expiration + refresh token = secure session [OK]

Hint: Short expiration plus refresh token on requests [OK]

Common Mistakes:

• Not refreshing tokens causing forced logouts
• Setting too long expiration risking security
• Ignoring expiration causing infinite sessions