JWT vs session-based decision in Spring Boot - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a JWT token with a secret key.

Spring Boot

String token = Jwts.builder().setSubject(user.getUsername()).signWith([1]).compact();

Drag options to blanks, or click blank then click option'

ASignatureAlgorithm.HS512

Bnew SecretKeySpec(secret.getBytes(), "HmacSHA256")

Cnull

DKeys.secretKeyFor(SignatureAlgorithm.HS256)

Attempts:

3 left

💡 Hint

Common Mistakes

Using null or incorrect signature algorithm causes errors.

Use Keys.secretKeyFor(SignatureAlgorithm.HS256) to generate a secure secret key for signing the JWT.

2fill in blank

medium

Complete the code to store user info in HTTP session.

Spring Boot

HttpSession session = request.getSession(); session.setAttribute("[1]", user);

Drag options to blanks, or click blank then click option'

AcurrentUser

Buser

CsessionUser

DuserInfo

Attempts:

3 left

💡 Hint

Common Mistakes

Using inconsistent attribute names causes retrieval issues.

The attribute name user is commonly used to store the user object in session.

3fill in blank

hard

Fix the error in the JWT validation code by completing the missing method.

Spring Boot

Jwts.parserBuilder().setSigningKey([1]).build().parseClaimsJws(token);

Drag options to blanks, or click blank then click option'

AsecretKey

Bnull

Ctoken

Duser.getPassword()

Attempts:

3 left

💡 Hint

Common Mistakes

Passing null or wrong key causes exceptions.

The setSigningKey method requires the secret key used to sign the token for validation.

4fill in blank

hard

Fill both blanks to configure session timeout and secure cookie.

Spring Boot

session.setMaxInactiveInterval([1]); response.addCookie(new Cookie("JSESSIONID", [2]));

Drag options to blanks, or click blank then click option'

A1800

B"secureValue"

C"HttpOnly"

D3600

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong timeout units or invalid cookie values.

Set session timeout to 1800 seconds (30 minutes) and add a secure cookie value.

5fill in blank

hard

Fill all three blanks to create a JWT with claims and expiration.

Spring Boot

String jwt = Jwts.builder().setSubject([1]).claim("role", [2]).setExpiration([3]).signWith(secretKey).compact();

Drag options to blanks, or click blank then click option'

Auser.getUsername()

B"admin"

Cnew Date(System.currentTimeMillis() + 3600000)

Duser.getPassword()

Attempts:

3 left

💡 Hint

Common Mistakes

Using password as subject or invalid expiration date.

Use the username as subject, set role claim to "admin", and expiration to 1 hour from now.