Stateless authentication mental model in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Stateless Authentication Tokens

In a stateless authentication system using JWTs (JSON Web Tokens), what happens when a user logs out?

A The server deletes the token from its session store to invalidate it.

B The server sends a new token with a logout flag to the client.

C The server marks the token as expired in a centralized database.

D The client deletes the token locally, and the server does not store any session data.

💡 Hint

Think about what 'stateless' means for the server's role in managing sessions.

In stateless authentication, the server does not keep session data. The client holds the token and deletes it on logout. The server simply verifies tokens on each request without storing them.

❓ component_behavior

intermediate

Token Validation in Stateless Authentication

Given a Spring Boot REST API using stateless JWT authentication, what is the server's behavior when it receives a request with an expired token?

A The server rejects the request with an unauthorized error without checking any session.

B The server refreshes the token automatically and processes the request.

C The server looks up the token in a session store to verify expiration.

D The server ignores the token and allows the request to proceed.

💡 Hint

Remember that stateless means no session store on the server.

The server checks the token's expiration by decoding it. If expired, it rejects the request with an unauthorized error. No session lookup is done.

📝 Syntax

advanced

Correct JWT Filter Configuration in Spring Boot

Which of the following Spring Boot filter configurations correctly implements stateless JWT authentication by validating tokens on each request?

Spring Boot

public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String token = extractToken(request);
        if (token != null && validateToken(token)) {
            UsernamePasswordAuthenticationToken auth = getAuthentication(token);
            SecurityContextHolder.getContext().setAuthentication(auth);
        }
        filterChain.doFilter(request, response);
    }
}

A Add the filter with session management set to IF_REQUIRED and enable CSRF.

B Add the filter with session management set to ALWAYS and disable CSRF.

C Add the filter with session management set to STATELESS and disable CSRF.

D Add the filter without configuring session management or CSRF.

💡 Hint

Stateless authentication requires no server session and CSRF protection is usually disabled for APIs.

Setting session management to STATELESS ensures no session is created. Disabling CSRF is common for stateless APIs because tokens protect requests.

🔧 Debug

advanced

Identifying the Cause of Token Rejection

A Spring Boot app using stateless JWT authentication rejects all valid tokens with an unauthorized error. Which code snippet is the most likely cause?

Spring Boot

public boolean validateToken(String token) {
    try {
        Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token);
        return true;
    } catch (ExpiredJwtException e) {
        return false;
    } catch (JwtException e) {
        return false;
    }
}

A The filter does not call filterChain.doFilter after validation.

B The secretKey used to parse tokens is different from the one used to sign them.

C The token is not extracted from the Authorization header correctly.

D The validateToken method does not catch all exceptions and crashes.

💡 Hint

Check if the key used to verify tokens matches the signing key.

If the secret key used to parse tokens differs from the signing key, all tokens will fail validation and be rejected.

❓ lifecycle

expert

Stateless Authentication Token Expiry and Refresh Flow

In a stateless JWT authentication system, which sequence correctly describes the lifecycle of token expiry and refresh to maintain user access without server session storage?

A 1, 2, 3, 4

B 1, 3, 2, 4

C 2, 1, 3, 4

D 1, 2, 4, 3

💡 Hint

Think about the order of client requests and server validations in token refresh.

The client first sends the access token. The server validates it. If expired, the client requests a new token using the refresh token. The server verifies the refresh token and issues a new access token.