JWT Validation - Interview Questions & Answers

JWT Validation is one of the most critical steps in JWT authentication. Receiving a JWT from a client does not mean it can be trusted. Every incoming token must be validated before granting access to protected resources.

In Spring Boot applications, JWT validation is typically handled by Spring Security or an API Gateway before the request reaches the business logic.

---

Q1. What is JWT Validation?

Answer

JWT Validation is the process of verifying whether a JWT is authentic, valid, and safe to use.

Validation ensures:

• The token was issued by a trusted issuer.
• The token has not been modified.
• The token has not expired.
• The token belongs to the intended audience.

JWT Validation Flow

flowchart LR
A[Incoming JWT] --> B[JWT Decoder] --> C[Signature Validation] --> D[Claims Validation] --> E[Authenticated User]

Without validation, attackers could forge or modify tokens.

---

Q2. Why is JWT Validation important?

Answer

A JWT is stored on the client side.

Anyone can send a fake JWT to your application.

Without validation, an attacker could change:

{
   "role":"USER"
}

to

{
   "role":"ADMIN"
}

Validation Process

flowchart TD
A[Client JWT] --> B[Validate Signature] --> C[Validate Claims] --> D[Grant Access]

Validation prevents unauthorized access.

---

Q3. What checks are performed during JWT Validation?

Answer

A production system validates multiple parts of the token.

Validation Checklist

• Signature
• Expiration (exp)
• Not Before (nbf)
• Issued At (iat)
• Issuer (iss)
• Audience (aud)
• Algorithm
• Required Claims

Validation Pipeline

flowchart TD
A[JWT] --> B[Verify Signature] --> C[Check Expiration] --> D[Validate Issuer] --> E[Validate Audience] --> F[Extract Claims] --> G[Authentication Success]

---

Q4. How does Spring Security validate JWTs?

Answer

Spring Security automatically validates JWTs using a configured JWT Decoder.

Typical validation steps include:

1. Decode JWT
2. Verify Signature
3. Validate Claims
4. Build Authentication
5. Store Authentication in SecurityContext

Spring Security Flow

flowchart TD
A[HTTP Request] --> B[Bearer Token] --> C[JWT Decoder] --> D[JWT Validator] --> E[SecurityContext] --> F[Controller]

If validation fails, Spring Security returns 401 Unauthorized.

---

Q5. What happens if JWT Signature validation fails?

Answer

If the signature does not match, the token is considered invalid.

The request should be rejected immediately.

Invalid Signature

flowchart TD
A[JWT] --> B[Verify Signature] --> C{Signature Valid?}

C -->|Yes| D[Continue]

C -->|No| E[401 Unauthorized]

Possible Reasons

• Token modified
• Wrong signing key
• Invalid algorithm
• Forged token

---

Q6. Why should the exp (Expiration) claim be validated?

Answer

The exp claim defines when the JWT expires.

Expired tokens should never be accepted.

Expiration Validation

flowchart LR
A[JWT] --> B[Read exp Claim] --> C{Expired?}

C -->|No| D[Allow Request]

C -->|Yes| E[Reject Request]

Best Practice

Keep Access Tokens short-lived (for example, minutes rather than days) and use Refresh Tokens where appropriate.

---

Q7. Why are iss (Issuer) and aud (Audience) validated?

Answer

Issuer (iss)

Verifies that the JWT was issued by a trusted Authorization Server.

Audience (aud)

Verifies that the token is intended for the current application.

Validation Flow

flowchart TD
A[JWT] --> B[Validate Issuer] --> C[Validate Audience] --> D[Accept Token]

Benefits

• Prevents token misuse
• Prevents token replay across applications
• Increases trust

---

Q8. What are common JWT Validation mistakes?

Answer

Common mistakes include:

• Skipping signature validation
• Ignoring expiration
• Ignoring issuer
• Ignoring audience
• Accepting unsigned tokens
• Allowing weak algorithms
• Not checking required claims

Wrong Flow

JWT

↓

Controller ❌

Correct Flow

JWT

↓

Validation

↓

Authentication

↓

Controller ✅

---

Q9. How does an API Gateway validate JWTs?

Answer

Many enterprise architectures validate JWTs at the API Gateway before forwarding requests.

Gateway Validation

flowchart TD
A[Client] --> B[API Gateway] --> C[JWT Validation] --> D[Spring Boot Service] --> E[Database]

Benefits

• Centralized security
• Reduced duplication
• Faster rejection of invalid requests
• Consistent authentication across microservices

Popular API Gateways include:

• Spring Cloud Gateway
• Kong
• AWS API Gateway
• Apigee
• NGINX

---

Q10. What are the enterprise best practices for JWT Validation?

Answer

Follow these best practices:

• Validate every incoming JWT.
• Verify the signature before reading claims.
• Validate expiration (exp).
• Validate issuer (iss).
• Validate audience (aud).
• Reject unsigned or malformed tokens.
• Use HTTPS for all communication.
• Keep Access Tokens short-lived.
• Rotate signing keys regularly.
• Log authentication failures.

Enterprise JWT Validation Architecture

flowchart TD
A[Client] --> B[HTTPS] --> C[API Gateway] --> D[JWT Validation] --> E[Spring Security] --> F[Business Service] --> G[Database]

Complete Validation Flow

flowchart LR
A[Incoming JWT] --> B[Decode Token] --> C[Verify Signature] --> D[Validate Claims] --> E[Create Authentication] --> F[SecurityContext] --> G[Protected API]

Senior Interview Tip

JWT validation should never stop at checking whether the token exists.

A production-ready system validates:

• Signature
• Expiration
• Issuer
• Audience
• Required Claims
• Token Format
• Signing Algorithm
• Token Revocation Strategy (when applicable)

Enterprise applications typically validate JWTs at the API Gateway, Spring Security Resource Server, or both, ensuring only trusted requests reach business services.

---

Quick Revision

• Every incoming JWT must be validated.
• Always verify the signature first.
• Validate exp, iss, and aud.
• Reject expired or malformed tokens.
• Spring Security performs JWT validation automatically when configured.
• API Gateways can centralize JWT validation.
• Use HTTPS for token transmission.
• Keep Access Tokens short-lived.
• Rotate signing keys regularly.
• Never trust a JWT until all validation checks succeed.