Exam Center

AI-Generated Content

This exam was created by a large language model. Please use it with caution, as inaccuracies may be present. Always verify critical information.

Which of the following correctly lists the three main parts of a JSON Web Token (JWT)?

Select one option

Header, Body, Footer

Header, Payload, Signature

Algorithm, Data, Key

Type, Claims, Hash

How are the Header and Payload sections of a JWT typically encoded?

Select one option

AES-256 encrypted

Base64Url encoded

MD5 hashed

RSA signed

What type of information is commonly stored within the Payload (claims) of an Access Token in a JWT-based authentication system?

Select one option

User's password hash and salt

Server's private key

User ID, roles, and token expiration time

Database connection string

For Single-Page Applications (SPAs) interacting with a backend API, where is an access JWT most commonly stored on the client-side?

Select one option

Session Storage

Local Storage

HttpOnly Cookie

Server-side Session

When making authenticated requests to a backend API from a SPA, how is the JWT access token typically sent?

Select one option

As a query parameter in the URL

In the request body as a JSON field

In the 'Authorization' HTTP header with the 'Basic' scheme

In the 'Authorization' HTTP header with the 'Bearer' scheme

Explain the primary purpose of a refresh token in JWT-based authentication and briefly describe its typical flow in an SPA context.

Since JWTs are self-contained and stateless, how can a server effectively invalidate or revoke an access token before its natural expiration? Describe at least two common strategies.

Discuss the security trade-offs of storing JWT access tokens in client-side 'Local Storage' versus 'HttpOnly Cookies' for Single-Page Applications (SPAs).

Imagine a user is logging into a Single-Page Application (SPA) that uses JWT-based authentication with a backend API. Describe the entire authentication flow from the user's login attempt to subsequent access of a protected resource, including the role of refresh tokens and key security considerations. Your explanation should cover:

User login process (sending credentials).
Server-side processing (authentication, token generation, issuance).
Client-side handling of the issued token (storage).
How the client sends the token on subsequent requests to access protected resources.
Server-side validation of the token for protected resource access.
The role and typical flow of refresh tokens in maintaining user sessions.
Key security considerations throughout the entire process.