Why JWT matters for APIs in Spring Boot - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of JWT in API security?

Consider a Spring Boot API that uses JWT for authentication. What is the main reason JWT is used in this context?

A To store user passwords safely on the client side

B To encrypt all API data so only the server can read it

C To replace HTTPS for secure communication

D To securely transmit user identity and claims between client and server without storing session state on the server

💡 Hint

Think about how JWT helps avoid server-side session storage.

JWT allows the server to verify user identity by checking the token signature without keeping session data, making APIs stateless and scalable.

❓ component_behavior

intermediate

How does a Spring Boot API behave when receiving an expired JWT?

In a Spring Boot API secured with JWT, what happens when a client sends a request with an expired JWT token?

A The API rejects the request with a 401 Unauthorized error

B The API accepts the request but logs a warning

C The API refreshes the token automatically and processes the request

D The API ignores the token and treats the request as anonymous

💡 Hint

Think about how JWT expiration affects authentication.

Expired JWT tokens are invalid, so the API rejects the request with a 401 error to prevent unauthorized access.

📝 Syntax

advanced

Identify the correct way to extract claims from a JWT in Spring Boot

Given the following code snippet to parse a JWT token, which option correctly extracts the 'username' claim?

Spring Boot

String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
Claims claims = Jwts.parserBuilder()
    .setSigningKey(secretKey)
    .build()
    .parseClaimsJws(token)
    .getBody();
// Extract username here

A String username = claims.get("username", String.class);

B String username = claims.getSubject();

C String username = claims.get("user", String.class);

D String username = claims.getIssuer();

💡 Hint

JWT standard uses a specific claim for the principal subject.

The 'sub' claim holds the principal identity, accessible via getSubject() method in Claims.

❓ state_output

advanced

What is the effect of missing JWT in a secured Spring Boot API request?

If a client sends a request to a Spring Boot API endpoint secured with JWT but does not include any JWT token, what will be the API's response?

A The API processes the request as an anonymous user

B The API responds with 403 Forbidden error

C The API responds with 401 Unauthorized error

D The API redirects the client to a login page

💡 Hint

Think about how Spring Security handles missing authentication tokens.

Without a JWT token, the API cannot authenticate the user, so it returns 401 Unauthorized.

🔧 Debug

expert

Why does this Spring Boot JWT validation code fail to reject tampered tokens?

Examine this JWT validation snippet in a Spring Boot API: String token = request.getHeader("Authorization").substring(7); Claims claims = Jwts.parser() .setSigningKey(secretKey) .parseClaimsJws(token) .getBody(); Why might this code fail to reject a JWT token that has been tampered with?

A Not catching exceptions from parseClaimsJws allows tampered tokens to pass silently

B The substring(7) call removes part of the token, causing parseClaimsJws to skip verification

C The secretKey is not decoded properly before use, so signature verification fails silently

D Using Jwts.parser() instead of Jwts.parserBuilder() causes the signature not to be verified properly

💡 Hint

Consider what happens if parseClaimsJws throws an exception and it is not handled.

If exceptions from parseClaimsJws are not caught, the application may continue processing without noticing the token is invalid.