JWT generation in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this JWT generation snippet?

Consider this Spring Boot code that generates a JWT token. What will be the value of token after execution?

Spring Boot

String token = Jwts.builder()
  .setSubject("user123")
  .setIssuedAt(new Date())
  .setExpiration(new Date(System.currentTimeMillis() + 60000))
  .signWith(Keys.hmacShaKeyFor("mysecretkeymysecretkeymysecretkey12".getBytes()), SignatureAlgorithm.HS256)
  .compact();

A A valid JWT string with header, payload containing subject 'user123', and signature

B A plain string 'user123' without any JWT structure

C Throws a runtime exception due to invalid key length

D An empty string because expiration is set in the past

💡 Hint

Look at the signWith method and the key length used.

The code creates a JWT token with subject 'user123', sets issued and expiration times, and signs it with a valid HMAC SHA-256 key. The result is a valid JWT string.

📝 Syntax

intermediate

Which option correctly fixes the syntax error in this JWT builder code?

Identify the correct fix for the syntax error in this JWT generation snippet:

Jwts.builder()
  .setSubject("user")
  .signWith(Keys.hmacShaKeyFor("secretkeysecretkeysecretkey12".getBytes())
  .compact();

A Remove the .compact() call at the end

B Add a closing parenthesis after getBytes(): .signWith(Keys.hmacShaKeyFor("secretkeysecretkeysecretkey12".getBytes()))

C Change .setSubject("user") to .setSubject(user)

D Replace Keys.hmacShaKeyFor with new SecretKeySpec

💡 Hint

Count the parentheses carefully.

The method call to hmacShaKeyFor is missing a closing parenthesis, causing a syntax error. Adding it fixes the code.

🔧 Debug

advanced

Why does this JWT generation code throw an InvalidKeyException?

Examine this code snippet:

byte[] keyBytes = "shortkey".getBytes();
SecretKey key = Keys.hmacShaKeyFor(keyBytes);
String token = Jwts.builder()
  .setSubject("admin")
  .signWith(key, SignatureAlgorithm.HS256)
  .compact();

Why does it throw an InvalidKeyException?

A The key length is too short for HS256 algorithm

B The subject 'admin' is not allowed in JWT

C The SignatureAlgorithm HS256 is deprecated

D The getBytes() method returns null

💡 Hint

Check the required key length for HMAC SHA-256.

HS256 requires a key of at least 256 bits (32 bytes). The provided key is shorter, causing the exception.

❓ state_output

advanced

What is the expiration time of the generated JWT token?

Given this code snippet:

long now = System.currentTimeMillis();
String token = Jwts.builder()
  .setSubject("user")
  .setIssuedAt(new Date(now))
  .setExpiration(new Date(now + 300000))
  .signWith(Keys.hmacShaKeyFor("mysecretkeymysecretkeymysecretkey12".getBytes()), SignatureAlgorithm.HS256)
  .compact();

How long is the token valid after issuance?

A 30 seconds

B 1 hour

C 5 minutes

D No expiration set

💡 Hint

Look at the value added to now for expiration.

The expiration is set to 300000 milliseconds (5 minutes) after the issued time.

🧠 Conceptual

expert

Which option best explains why JWT tokens are stateless in Spring Boot applications?

Why are JWT tokens considered stateless when used for authentication in Spring Boot?

A Because JWT tokens require server memory to track each token's state

B Because Spring Boot stores JWT tokens in a centralized database

C Because JWT tokens expire immediately after creation

D Because all user information and claims are stored inside the token itself, no server-side session is needed

💡 Hint

Think about where the user data lives when using JWT.

JWT tokens carry all necessary user data and claims inside the token, so the server does not need to keep session state, making them stateless.

Practice

1. What is the main purpose of generating a JWT (JSON Web Token) in a Spring Boot application?

easy

A. To securely identify users without storing session data on the server

B. To store user passwords in the database

C. To create HTML pages dynamically

D. To manage database connections

Solution

1. Step 1: Understand JWT purpose

   JWTs are used to securely identify users by encoding user info and signing it.

2. Step 2: Compare options

   Only To securely identify users without storing session data on the server describes JWT's role in stateless authentication without server sessions.

3. Final Answer:

   To securely identify users without storing session data on the server -> Option A

4. Quick Check:

   JWT purpose = secure user identity without sessions [OK]

Hint: JWTs identify users without server sessions [OK]

Common Mistakes:

• Confusing JWT with session storage
• Thinking JWT stores passwords
• Assuming JWT creates web pages

2. Which of the following code snippets correctly initializes a JWT builder using the jjwt library in Spring Boot?

easy

A. JwtBuilder().setSubject("user").sign(secretKey).build();

B. Jwts.builder().subject("user").sign(secretKey).compact();

C. Jwts.create().subject("user").signWith(secretKey).generate();

D. Jwts.builder().setSubject("user").signWith(secretKey).compact();

Solution

1. Step 1: Recall jjwt syntax

   The correct method chain starts with Jwts.builder(), uses setSubject(), signWith(), then compact().

2. Step 2: Check each option

   Jwts.builder().setSubject("user").signWith(secretKey).compact(); matches the correct method names and order. Others use incorrect method names or chaining.

3. Final Answer:

   Jwts.builder().setSubject("user").signWith(secretKey).compact(); -> Option D

4. Quick Check:

   Correct jjwt builder syntax = Jwts.builder().setSubject("user").signWith(secretKey).compact(); [OK]

Hint: Use Jwts.builder(), setSubject(), signWith(), compact() [OK]

Common Mistakes:

• Using incorrect method names like sign() instead of signWith()
• Missing Jwts.builder() start
• Using create() or build() instead of compact()

3. Given the following code snippet, what will be the output type of the token variable?

String token = Jwts.builder()
  .setSubject("user123")
  .signWith(secretKey)
  .compact();

medium

A. A JSON object representing the token

B. A signed JWT string token

C. A byte array of the token

D. An exception is thrown

Solution

1. Step 1: Understand compact() output

   The compact() method returns the JWT as a compact URL-safe string.

2. Step 2: Analyze code snippet

   The code builds a JWT with subject and signs it, then calls compact(), so token is a String.

3. Final Answer:

   A signed JWT string token -> Option B

4. Quick Check:

   compact() returns String token [OK]

Hint: compact() returns JWT as a string [OK]

Common Mistakes:

• Expecting a JSON object instead of string
• Thinking output is byte array
• Assuming code throws exception without error

4. Identify the error in this JWT generation code snippet:

String token = Jwts.builder()
  .setSubject("user")
  .signWith("mySecretKey")
  .compact();

medium

A. Jwts.builder() is not a valid method

B. setSubject() cannot accept a String

C. signWith() requires a Key object, not a String

D. compact() should be called before signWith()

Solution

1. Step 1: Check signWith() parameter type

   signWith() expects a java.security.Key or SecretKey, not a plain String.

2. Step 2: Verify other methods

   setSubject() accepts String, compact() is correctly called last, and Jwts.builder() is valid.

3. Final Answer:

   signWith() requires a Key object, not a String -> Option C

4. Quick Check:

   signWith() needs Key, not String [OK]

Hint: Use Key object with signWith(), not plain String [OK]

Common Mistakes:

• Passing String directly to signWith()
• Calling compact() too early
• Misunderstanding setSubject() input

5. You want to generate a JWT in Spring Boot that expires in 10 minutes. Which code snippet correctly sets the expiration time using jjwt?

hard

A. Jwts.builder().setSubject("user").setExpiration(new Date(System.currentTimeMillis() + 600000)).signWith(secretKey).compact();

B. Jwts.builder().setSubject("user").setExpiry(600000).signWith(secretKey).compact();

C. Jwts.builder().setSubject("user").setExpiration(600000).signWith(secretKey).compact();

D. Jwts.builder().setSubject("user").setExpiresAt(new Date(600000)).signWith(secretKey).compact();

Solution

1. Step 1: Understand expiration setting in jjwt

   setExpiration() expects a Date object representing the expiration time.

2. Step 2: Calculate expiration time

   Use current time plus 600000 milliseconds (10 minutes) to set expiration correctly.

3. Step 3: Check options

   Only Jwts.builder().setSubject("user").setExpiration(new Date(System.currentTimeMillis() + 600000)).signWith(secretKey).compact(); correctly uses setExpiration() with new Date(System.currentTimeMillis() + 600000).

4. Final Answer:

   Jwts.builder().setSubject("user").setExpiration(new Date(System.currentTimeMillis() + 600000)).signWith(secretKey).compact(); -> Option A

5. Quick Check:

   setExpiration(Date) with currentTime + 10min = Jwts.builder().setSubject("user").setExpiration(new Date(System.currentTimeMillis() + 600000)).signWith(secretKey).compact(); [OK]

Hint: Use setExpiration(new Date(System.currentTimeMillis() + millis)) [OK]

Common Mistakes:

• Using setExpiry() or setExpiresAt() which don't exist
• Passing milliseconds directly instead of Date
• Setting expiration to a fixed past date