Authentication · interview question
Which statement about JWT payloads is correct?
Multiple choiceEasychapter-17-curatedpremiumauthenticationjwt
Answer and explanation
Correct answer
B. They are readable claims data, so sensitive secrets should not be stored there
Why
JWT payloads carry claims, but they are only encoded, not hidden. Anyone holding the token can inspect them, so secrets like passwords or card data do not belong there.
Test yourself on Authentication
A free test with instant, explained results. No account needed.
More Authentication questions
- In the context of JWT, what is the primary purpose of the signature?
- How can a Java developer verify the signature of a JWT using HMAC SHA-256?
- How would you explain a significant consequence of using stateless JWT tokens for authentication in an interview?
- Which statement best describes the use of CSRF tokens in web applications?
- Why is using BCrypt preferable over a fast hashing algorithm like SHA-256 for password hashing?
- Which aspect of JWT usage can lead to vulnerabilities if not properly managed?