Authentication · interview question
How can a Java developer verify the signature of a JWT using HMAC SHA-256?
Multiple choiceMediumchapter-17-curatedpremiumauthenticationjwt-signatures
Answer and explanation
Correct answer
D. By using a secret key shared between the server and client.
Why
To verify a JWT signature with HMAC SHA-256, the server uses a secret key that should be known only to the server. This key is used to recompute the signature, which is then compared to the signature in the token to ensure integrity.
Test yourself on Authentication
A free test with instant, explained results. No account needed.
More Authentication questions
- In the context of JWT, what is the primary purpose of the signature?
- How would you explain a significant consequence of using stateless JWT tokens for authentication in an interview?
- Which statement about JWT payloads is correct?
- Which statement best describes the use of CSRF tokens in web applications?
- Why is using BCrypt preferable over a fast hashing algorithm like SHA-256 for password hashing?
- Which aspect of JWT usage can lead to vulnerabilities if not properly managed?