Backend interview prep

Start

JWT (JSON Web Token) Interview Questions and Answers

Top 10 JWT interview questions with Mermaid diagrams, production scenarios, Spring Security integration, and enterprise best practices.

JWT (JSON Web Token) - Interview Questions & Answers

JWT (JSON Web Token) is one of the most widely used authentication mechanisms in modern REST APIs and Microservices. It enables stateless authentication, allowing applications to scale horizontally without maintaining server-side sessions.

JWT is defined in RFC 7519 and is commonly used with Spring Security, OAuth2, API Gateways, and Cloud-Native applications.

Q1. What is JWT?

Answer

JWT (JSON Web Token) is a compact, URL-safe token used to securely transfer claims between two parties.

It is commonly used for:

  • Authentication
  • Authorization
  • User Identity
  • API Security

After successful login, the server generates a JWT and sends it to the client.

The client includes the token in every subsequent request.

JWT Authentication Flow

flowchart LR
A[User Login] --> B[Spring Security] --> C[JWT Generated] --> D[Client Stores JWT] --> E[HTTP Request] --> F[Authorization Header] --> G[Protected API]

Q2. What is the structure of a JWT?

Answer

A JWT consists of three parts separated by dots (.).

Header.Payload.Signature

JWT Structure

flowchart LR
A[JWT]

A --> B[Header]

A --> C[Payload]

A --> D[Signature]

Contains metadata.

Example:

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

Contains claims.

Example:

{
  "sub": "john",
  "role": "ADMIN",
  "exp": 1750000000
}

Signature

Protects the token from tampering.

Q3. How does JWT authentication work?

Answer

JWT authentication follows these steps:

  1. User logs in.
  2. Credentials are validated.
  3. JWT is generated.
  4. Client stores JWT.
  5. Client sends JWT with every request.
  6. Server validates JWT.
  7. Access is granted.

JWT Login Flow

sequenceDiagram
participant User
participant Client
participant SpringSecurity
participant API
User->>Client: Login
Client->>SpringSecurity: Username & Password
SpringSecurity-->>Client: JWT
Client->>API: Request + JWT
API->>SpringSecurity: Validate JWT
SpringSecurity-->>API: Authentication Success
API-->>Client: Response

Q4. What are JWT Claims?

Answer

Claims are pieces of information stored inside the JWT payload.

Standard Claims

Claim Meaning
sub Subject
iss Issuer
aud Audience
exp Expiration Time
iat Issued At
nbf Not Before
jti JWT ID

Custom Claims

{
  "username": "john",
  "role": "ADMIN",
  "department": "Finance"
}

Claims Diagram

flowchart TD
A[JWT Payload]

A --> B[sub]

A --> C[role]

A --> D[exp]

A --> E[department]

Q5. Where should a JWT be stored?

Answer

Storage depends on the application type.

Application Recommended Storage
Web App HttpOnly Secure Cookie
SPA Secure Cookie (Preferred)
Mobile App Secure Storage / Keychain
Backend Services Memory

Storage Flow

flowchart LR
A[JWT] --> B[Secure Cookie] --> C[Browser] --> D[API Request]

Interview Tip

Avoid storing JWTs in Local Storage for sensitive applications because they are vulnerable to XSS attacks.

Q6. What are the advantages and disadvantages of JWT?

Answer

Advantages

  • Stateless authentication
  • Scalable
  • Fast
  • No server-side sessions
  • Works well with microservices

Disadvantages

  • Difficult to revoke immediately
  • Larger than session IDs
  • Requires careful expiration handling
  • Token leakage risk if stored insecurely

Stateless Authentication

flowchart TD
A[Client] --> B[JWT] --> C[API Gateway] --> D[Microservice 1]

C --> E[Microservice 2]

C --> F[Microservice 3]

Q7. How does Spring Security validate a JWT?

Answer

Spring Security validates the JWT before processing the request.

Validation includes:

  • Signature Verification
  • Expiration Check
  • Issuer Validation
  • Audience Validation
  • Claims Validation

Validation Flow

flowchart TD
A[Incoming Request] --> B[JWT Filter] --> C[Validate Signature] --> D[Check Expiration] --> E[Extract Claims] --> F[SecurityContext] --> G[Controller]

If validation fails, the request is rejected.

Q8. What is the difference between Session Authentication and JWT Authentication?

Answer

Session JWT
Stateful Stateless
Server Stores Session Client Stores Token
Session ID JWT
Easy Logout Requires Token Strategy
Good for MVC Best for REST APIs

Comparison

flowchart LR
A[Session Authentication] --> B[Server Session]

C[JWT Authentication] --> D[Client Token]

Enterprise Recommendation

  • MVC Applications → Session Authentication
  • REST APIs & Microservices → JWT Authentication

Q9. What are the JWT security best practices?

Answer

Follow these best practices:

  • Always use HTTPS.
  • Keep JWT expiration short.
  • Validate every token.
  • Use Refresh Tokens.
  • Rotate signing keys.
  • Never expose secret keys.
  • Store JWT securely.
  • Include only required claims.
  • Validate issuer and audience.
  • Log authentication failures.

Secure JWT Flow

flowchart TD
A[Client] --> B[HTTPS] --> C[JWT] --> D[API Gateway] --> E[Spring Security] --> F[Protected API]

Answer

Enterprise applications use JWT with OAuth2 and API Gateways.

Enterprise Architecture

flowchart TD
A[User] --> B[Browser / Mobile] --> C[OAuth2 Authorization Server] --> D[JWT Access Token] --> E[API Gateway] --> F[Spring Security Resource Server] --> G[Microservices] --> H[Database]

JWT Validation Flow

flowchart LR
A[Client] --> B[JWT] --> C[API Gateway] --> D[JWT Validation] --> E[Spring Boot] --> F[Business Service]

Senior Interview Tip

JWT is ideal for stateless authentication but should be implemented carefully.

A production-ready JWT solution typically includes:

  • OAuth2 Authorization Server
  • Spring Security Resource Server
  • JWT Access Tokens
  • Refresh Tokens
  • Short Token Expiration
  • HTTPS
  • Secure Cookies (for browsers)
  • API Gateway Validation
  • Key Rotation
  • Monitoring & Auditing

Remember:

  • JWT is a token format.
  • OAuth2 is an authorization framework.
  • Spring Security validates and processes JWTs.

Quick Revision

  • JWT stands for JSON Web Token.
  • JWT contains Header, Payload, and Signature.
  • JWT enables stateless authentication.
  • JWT is commonly used for REST APIs and Microservices.
  • Store JWT securely (prefer HttpOnly cookies for web apps).
  • Always validate signature and expiration.
  • Use Refresh Tokens with short-lived Access Tokens.
  • Always use HTTPS.
  • Rotate signing keys regularly.
  • Enterprise applications combine JWT, OAuth2, API Gateways, and Spring Security.