JWT validation filter in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a JWT is missing in the request header?

Consider a Spring Boot JWT validation filter that checks the Authorization header for a JWT token. What is the typical behavior of the filter when the JWT token is missing?

A The filter rejects the request and responds with HTTP 401 Unauthorized.

B The filter allows the request to proceed without authentication.

C The filter throws a NullPointerException and crashes the application.

D The filter redirects the user to a login page.

💡 Hint

Think about security best practices for protected endpoints.

When a JWT token is missing, the filter should reject the request with a 401 status to prevent unauthorized access.

📝 Syntax

intermediate

Which code snippet correctly extracts the JWT token from the Authorization header?

Given the Authorization header value 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...', which code correctly extracts the token string after 'Bearer '?

A String token = authorizationHeader.replace("Bearer", "");

B String token = authorizationHeader.split("Bearer")[1];

C String token = authorizationHeader.substring(6);

D String token = authorizationHeader.substring(7);

💡 Hint

Remember that 'Bearer ' includes a space after the word.

The token starts after the 7th character because 'Bearer ' is 7 characters long including the space.

🔧 Debug

advanced

Why does this JWT validation filter always reject valid tokens?

Review this filter code snippet that validates JWT tokens. It always rejects tokens even if they are valid. ```java String token = authorizationHeader.substring(7); Claims claims = Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token).getBody(); if (claims.getExpiration().before(new Date())) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); return; } chain.doFilter(request, response); ``` What is the likely cause?

Spring Boot

String token = authorizationHeader.substring(7);
Claims claims = Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token).getBody();
if (claims.getExpiration().before(new Date())) {
  response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
  return;
}
chain.doFilter(request, response);

A The filter uses 'before' instead of 'after' to check expiration, so it rejects tokens that are still valid.

B The token substring is off by one character, causing parsing errors.

C The secretKey is incorrect, causing all tokens to fail signature validation.

D The filter does not call chain.doFilter() when the token is valid.

💡 Hint

Check the logic comparing expiration date with current date.

The condition should reject tokens expired before now, so 'before(new Date())' means token expired. The code is correct logically, but the question states it always rejects valid tokens, so the problem is likely the secretKey is incorrect causing signature validation to fail.

❓ state_output

advanced

What is the value of SecurityContext after a valid JWT is processed?

In a Spring Boot JWT validation filter, after successfully validating a JWT token and extracting user details, the filter sets the authentication in the SecurityContext. What will SecurityContextHolder.getContext().getAuthentication() return?

A Null, because the filter does not set any authentication.

B An Authentication object containing the user's username and granted authorities.

C A JWT token string representing the user's session.

D An exception is thrown because SecurityContext is immutable.

💡 Hint

Think about how Spring Security stores user info after authentication.

After validating the JWT, the filter creates an Authentication object (like UsernamePasswordAuthenticationToken) and sets it in the SecurityContext, so it holds user identity and roles.

🧠 Conceptual

expert

Why should a JWT validation filter be stateless and not store session data?

In designing a JWT validation filter for a Spring Boot application, why is it important that the filter remains stateless and does not store session data on the server?

A Because JWT tokens contain all necessary user info, so server-side sessions are redundant and reduce scalability.

B Because storing session data causes JWT tokens to expire immediately.

C Because stateless filters automatically refresh JWT tokens without client interaction.

D Because Spring Boot does not support session management with JWT tokens.

💡 Hint

Consider how JWT tokens carry user data and how server memory is affected.

JWT tokens are self-contained and include user claims, so the server does not need to keep session state. This improves scalability and simplifies load balancing.