JWT Signing - Interview Questions & Answers

JWT Signing is one of the most important security concepts in JWT authentication. The signature ensures that the token has not been modified and was issued by a trusted authority.

Without a signature, anyone could modify the JWT payload and gain unauthorized access.

JWT signing provides:

• Integrity
• Authenticity
• Tamper Detection

---

Q1. What is JWT Signing?

Answer

JWT Signing is the process of generating a digital signature using the JWT Header, Payload, and a cryptographic key.

The generated signature is attached to the JWT.

JWT Signing Process

flowchart LR
A[Header] --> D[Signing Algorithm]

B[Payload] --> D

C[Secret Key / Private Key] --> D

D --> E[JWT Signature]

E --> F[Complete JWT]

The signature guarantees that the token has not been modified.

---

Q2. Why is JWT Signing important?

Answer

JWT Signing protects the token from tampering.

Without signing, an attacker could change:

{
   "role":"USER"
}

to

{
   "role":"ADMIN"
}

A valid signature prevents this attack.

Tampering Detection

flowchart TD
A[JWT] --> B[Payload Modified] --> C[Signature Validation] --> D[Validation Failed]

Benefits

• Integrity
• Authenticity
• Tamper Detection

---

Q3. How is a JWT Signature generated?

Answer

The signature is generated using:

Base64Url(Header)
+
"."
+
Base64Url(Payload)

This data is signed using the configured algorithm.

Signing Flow

flowchart TD
A[Header] --> B[Base64URL Encode]

C[Payload] --> D[Base64URL Encode]

B --> E[Combine]

D --> E

E --> F[Sign Using Key]

F --> G[JWT Signature]

The resulting signature becomes the third part of the JWT.

---

Q4. What is HS256?

Answer

HS256 (HMAC SHA-256) is a symmetric signing algorithm.

The same secret key is used to:

• Sign the JWT
• Verify the JWT

HS256 Flow

flowchart LR
A[JWT] --> B[HS256]

C[Shared Secret] --> B

B --> D[Signed JWT]

D --> E[Verify Using Same Secret]

Advantages

• Fast
• Easy to implement
• Good for internal applications

Limitation

All services that verify tokens must know the shared secret.

---

Q5. What is RS256?

Answer

RS256 uses RSA asymmetric cryptography.

It uses:

• Private Key → Sign
• Public Key → Verify

RS256 Flow

flowchart LR
A[JWT] --> B[Private Key] --> C[RS256 Signature] --> D[Public Key] --> E[Verify JWT]

Advantages

• Better security
• Public key distribution
• Suitable for distributed systems

Enterprise Recommendation

Use RS256 for large enterprise and microservice architectures.

---

Q6. What is the difference between HS256 and RS256?

Answer

HS256	RS256
Symmetric	Asymmetric
One Secret Key	Public & Private Keys
Faster	Slightly Slower
Internal Systems	Enterprise APIs
Easier Setup	Better Key Management

Comparison

flowchart TD
A[JWT Signing]

A --> B[HS256]

A --> C[RS256]

B --> D[Shared Secret]

C --> E[Private Key]

E --> F[Public Key Verification]

Interview Tip

OAuth2 Authorization Servers commonly use RS256 because resource servers only need the public key.

---

Q7. How does Spring Security verify a JWT Signature?

Answer

Spring Security validates the signature before trusting the token.

Validation includes:

• Signature Verification
• Expiration Check
• Issuer Validation
• Audience Validation
• Claims Validation

Validation Flow

flowchart TD
A[Incoming JWT] --> B[Decode Header] --> C[Verify Signature] --> D[Validate Claims] --> E[SecurityContext] --> F[Protected API]

If verification fails, Spring Security returns 401 Unauthorized.

---

Q8. What are common JWT signing mistakes?

Answer

Common mistakes include:

• Weak signing keys
• Hardcoding secrets
• Using the none algorithm
• Long-lived tokens
• Not rotating keys
• Exposing private keys
• Sharing private keys across applications
• Disabling signature verification

Wrong Design

Secret Key

↓

application.properties ❌

Correct Design

Private Key

↓

AWS KMS / Vault ✅

---

Q9. How should signing keys be managed?

Answer

Signing keys are critical assets and should be protected.

Best Practices

• Store keys in AWS KMS
• Use HashiCorp Vault
• Rotate keys regularly
• Restrict access
• Enable audit logging
• Use HSM-backed keys when required

Key Management

flowchart LR
A[Spring Boot] --> B[AWS KMS / Vault] --> C[Private Key] --> D[JWT Signing]

---

Q10. What are the enterprise best practices for JWT Signing?

Answer

Follow these best practices:

• Use RS256 or ES256 for distributed systems.
• Use HS256 only for trusted internal environments when symmetric key management is appropriate.
• Rotate signing keys regularly.
• Store keys in KMS or Vault.
• Validate issuer, audience, and expiration.
• Never expose private keys.
• Keep Access Tokens short-lived.
• Always use HTTPS.
• Log signature validation failures.
• Monitor authentication events.

Enterprise JWT Architecture

flowchart TD
A[User] --> B[OAuth2 Authorization Server] --> C[Private Key] --> D[Signed JWT] --> E[API Gateway] --> F[Spring Security] --> G[Public Key Verification] --> H[Microservices]

Complete JWT Verification

flowchart LR
A[JWT] --> B[Decode] --> C[Verify Signature] --> D[Validate Claims] --> E[Authorize User]

Senior Interview Tip

In enterprise systems:

• Authorization Server signs JWTs using a Private Key.
• API Gateway and Resource Servers verify JWTs using the corresponding Public Key.
• This approach allows multiple services to validate tokens without exposing the signing key.

For scalable architectures:

• Use RS256 or ES256.
• Protect keys with AWS KMS, Azure Key Vault, or HashiCorp Vault.
• Rotate keys periodically using a managed key lifecycle.

---

Quick Revision

• JWT Signing protects token integrity.
• The signature is created using the Header, Payload, and a cryptographic key.
• HS256 uses a shared secret.
• RS256 uses a Private Key for signing and a Public Key for verification.
• Spring Security validates the signature before processing requests.
• Never use the none algorithm.
• Protect signing keys using KMS or Vault.
• Rotate signing keys regularly.
• Always validate issuer, audience, and expiration.
• Enterprise systems commonly use RS256 or ES256 with centralized key management.