JWT vs session-based decision in Spring Boot - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

When to prefer JWT over session-based authentication?

Which scenario best justifies using JWT instead of session-based authentication in a Spring Boot application?

A You want to store user data only on the server and keep tokens minimal.

B You want to maintain server-side session state for each user to easily revoke access.

C You want to rely on server memory to track user sessions for quick invalidation.

D You need a stateless authentication mechanism that works well with multiple microservices.

💡 Hint

Think about whether the authentication needs to be stateless or stateful.

JWT is best when you want stateless authentication, especially across distributed systems like microservices. Session-based authentication keeps state on the server, which can be harder to scale.

❓ component_behavior

intermediate

Effect of token expiration in JWT vs session

In a Spring Boot app using JWT, what happens when the JWT token expires compared to session expiration in session-based authentication?

A JWT tokens never expire; session expiration depends on client-side cookie settings.

B JWT token expiration forces client to get a new token; session expiration requires server to clear session data.

C JWT token expiration automatically refreshes the token; session expiration logs out the user immediately.

D JWT token expiration clears server session; session expiration invalidates JWT tokens.

💡 Hint

Consider where the expiration is checked and who manages it.

JWT tokens carry their own expiration and the client must request a new token after expiry. Sessions expire on the server side and require server cleanup.

🔧 Debug

advanced

Why does a Spring Boot app reject a valid JWT token?

Given a Spring Boot app using JWT authentication, which option explains why a valid JWT token might be rejected during request processing?

A The token is expired but the server ignores expiration checks.

B The token's signature algorithm does not match the server's expected algorithm.

C The token is signed with the correct key but the server's clock is ahead causing premature expiration.

D The token payload is missing the 'sub' claim but the server does not require it.

💡 Hint

Think about time synchronization between client and server.

If the server's clock is ahead, it may consider the token expired even if the client just received it. This causes valid tokens to be rejected.

❓ state_output

advanced

Session state behavior after server restart

What happens to user sessions in a Spring Boot app using session-based authentication if the server restarts without session persistence?

A All user sessions are lost and users must log in again.

B Sessions remain active because they are stored in client cookies.

C Sessions are automatically restored from JWT tokens stored on the client.

D Only sessions with 'remember me' enabled are preserved.

💡 Hint

Consider where session data is stored and what happens on server restart.

Session data is stored in server memory by default. Without persistence, restarting the server clears all sessions, forcing users to log in again.

📝 Syntax

expert

Correct JWT filter configuration in Spring Boot

Which code snippet correctly configures a JWT authentication filter in a Spring Boot security filter chain?

Spring Boot

public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(csrf -> csrf.disable())
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated()
        )
        .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
        .build();
}

A Add the JWT filter before UsernamePasswordAuthenticationFilter to process token before username/password checks.

B Add the JWT filter replacing UsernamePasswordAuthenticationFilter to avoid duplicate authentication.

C Add the JWT filter as the last filter in the chain to catch all requests after authentication.

D Add the JWT filter after UsernamePasswordAuthenticationFilter to ensure authentication happens first.

💡 Hint

Think about when the JWT token should be checked relative to username/password authentication.

The JWT filter must run before UsernamePasswordAuthenticationFilter to extract and validate the token before Spring Security processes authentication.