JWT Basics Interview Questions and Answers
Top 10 JWT Basics interview questions with Mermaid diagrams, Spring Security examples, production scenarios, and enterprise best practices.
JWT Basics - Interview Questions & Answers
JWT (JSON Web Token) is the most commonly used token format for securing REST APIs and Microservices. It enables stateless authentication, making applications scalable without maintaining server-side sessions.
JWT is defined by RFC 7519 and is widely used with Spring Security, OAuth2, API Gateways, Kubernetes, and Cloud-native applications.
Q1. What is JWT?
Answer
JWT (JSON Web Token) is a compact, URL-safe token that securely transfers user information (claims) between two parties.
It is commonly used for:
- Authentication
- Authorization
- User Identity
- Secure API Communication
JWT Authentication Flow
flowchart LR
A[User Login] --> B[Spring Security] --> C[Generate JWT] --> D[Client] --> E[Authorization Header] --> F[Protected REST API]
Example JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiJ2ZW51Iiwicm9sZSI6IkFETUlOIiwiZXhwIjoxNzUwMDAwMDAwfQ.
kSx8Lm4P...
Q2. Why do we use JWT?
Answer
JWT eliminates the need to store user sessions on the server.
Benefits include:
- Stateless Authentication
- Better Scalability
- Faster API Requests
- Easy Microservice Integration
- Reduced Server Memory Usage
Stateless Authentication
flowchart TD
A[Client] --> B[JWT] --> C[API Gateway] --> D[Microservice]
The server validates the token without maintaining session data.
Q3. What is the structure of a JWT?
Answer
A JWT consists of three parts separated by dots (.).
Header.Payload.Signature
JWT Structure
flowchart LR
A[JWT]
A --> B[Header]
A --> C[Payload]
A --> D[Signature]
Header
Contains metadata.
{
"alg":"HS256",
"typ":"JWT"
}
Payload
Contains claims.
{
"sub":"venu",
"role":"ADMIN",
"exp":1750000000
}
Signature
Protects the token from tampering.
Q4. What are JWT Claims?
Answer
Claims are pieces of information stored inside the JWT payload.
Standard Claims
| Claim | Meaning |
|---|---|
| sub | Subject |
| iss | Issuer |
| aud | Audience |
| exp | Expiration Time |
| iat | Issued At |
| nbf | Not Before |
| jti | JWT ID |
Custom Claims
- username
- role
- department
- permissions
Claims Diagram
flowchart TD
A[JWT Payload]
A --> B[sub]
A --> C[role]
A --> D[exp]
A --> E[department]
Q5. How does JWT authentication work?
Answer
JWT authentication follows a request-response cycle.
Authentication Flow
sequenceDiagram
participant User
participant Client
participant SpringSecurity
participant API
User->>Client: Login
Client->>SpringSecurity: Username & Password
SpringSecurity-->>Client: JWT Token
Client->>API: Authorization: Bearer JWT
API->>SpringSecurity: Validate Token
SpringSecurity-->>API: Authentication Success
API-->>Client: Protected Response
Steps
- User logs in.
- Server validates credentials.
- JWT is generated.
- Client stores the JWT.
- JWT is sent with every request.
- Server validates the token.
Q6. Where should JWT be stored?
Answer
JWT storage depends on the client application.
| Client | Recommended Storage |
|---|---|
| Web Application | HttpOnly Secure Cookie |
| SPA | Secure Cookie |
| Mobile App | Secure Storage / Keychain |
| Backend Service | Memory |
Storage Flow
flowchart LR
A[JWT] --> B[Secure Cookie] --> C[Browser] --> D[REST API]
Interview Tip
Avoid storing JWTs in Local Storage for sensitive applications because of XSS risks.
Q7. What are the advantages and disadvantages of JWT?
Answer
Advantages
- Stateless
- Scalable
- Fast
- Self-contained
- Ideal for Microservices
Disadvantages
- Difficult to revoke immediately
- Larger than Session IDs
- Token leakage risk
- Requires expiration management
Comparison
flowchart LR
A[Session] --> B[Server Stores Session]
C[JWT] --> D[Client Stores Token]
Q8. How does Spring Security validate a JWT?
Answer
Spring Security validates every incoming JWT before allowing access.
Validation includes:
- Signature Verification
- Expiration Check
- Issuer Validation
- Audience Validation
- Claims Validation
Validation Flow
flowchart TD
A[Incoming Request] --> B[JWT Filter] --> C[Validate Signature] --> D[Validate Claims] --> E[SecurityContext] --> F[Controller]
If validation fails, Spring Security returns 401 Unauthorized.
Q9. What are common JWT mistakes?
Answer
Common mistakes include:
- Using long expiration times
- Storing JWT in Local Storage
- Weak signing keys
- Not validating issuer
- Not validating audience
- Including sensitive information in the payload
- Using HTTP instead of HTTPS
Wrong Design
JWT
↓
Local Storage ❌
Correct Design
JWT
↓
HttpOnly Secure Cookie ✅
Q10. What are the enterprise best practices for JWT?
Answer
Follow these best practices:
- Always use HTTPS.
- Keep Access Tokens short-lived.
- Use Refresh Tokens.
- Rotate signing keys.
- Validate issuer and audience.
- Store JWT securely.
- Never include passwords or sensitive data in the payload.
- Protect APIs using Spring Security.
- Log authentication failures.
- Monitor suspicious token usage.
Enterprise JWT Architecture
flowchart TD
A[User] --> B[OAuth2 Authorization Server] --> C[JWT Access Token] --> D[API Gateway] --> E[Spring Security] --> F[Microservices] --> G[Database]
Complete Authentication Flow
flowchart LR
A[User Login] --> B[Authentication Server] --> C[JWT] --> D[API Gateway] --> E[Spring Boot API] --> F[Business Service]
Senior Interview Tip
JWT is a token format, not an authentication protocol.
A production-ready JWT solution typically includes:
- OAuth2 or OpenID Connect
- Spring Security
- JWT Access Tokens
- Refresh Tokens
- HTTPS/TLS 1.3
- API Gateway Validation
- Short Token Expiration
- Secure Cookie Storage
- Key Rotation
- Audit Logging
Enterprise systems combine JWT with OAuth2, API Gateways, and Zero Trust Architecture to build secure, scalable, and stateless applications.
Quick Revision
- JWT stands for JSON Web Token.
- JWT has three parts: Header, Payload, and Signature.
- JWT enables stateless authentication.
- Claims store user information.
- Spring Security validates JWT before every request.
- Store JWT in HttpOnly Secure Cookies for web applications.
- Use short-lived Access Tokens.
- Always use HTTPS.
- Never store sensitive information in the JWT payload.
- Combine JWT with OAuth2, Spring Security, and API Gateways for enterprise applications.