All 15 Authentication & Authorization questions
More in Authentication & Authorization
What is the difference between authentication and authorization in a Node.js application? How should passwords be securely stored in a Node.js application's database, and why is bcrypt commonly used? What is the difference between storing an authentication token in localStorage versus an httpOnly cookie, from a security perspective? How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle? What is Passport.js, and how do its 'strategies' provide a consistent authentication abstraction across different methods? What is Role-Based Access Control (RBAC), and how would you implement it as Express middleware? What is CSRF (Cross-Site Request Forgery), and how do you protect a Node.js session-based application against it? How do you implement email verification and password-reset flows securely in a Node.js application? How would you implement Attribute-Based Access Control (ABAC) in a Node.js application when RBAC roles aren't expressive enough? How do you implement JWT refresh token rotation in a Node.js API, and why is it more secure than a single long-lived token?
Advertisement
Node.js › Authentication & Authorization

What is a JSON Web Token (JWT), and what are its three parts?

Intermediate

Answer

A JWT is a compact, self-contained, digitally signed token used to represent claims (like a user's identity and permissions) that can be verified without needing a server-side lookup, unlike a session ID. It consists of three base64url-encoded, dot-separated parts: a header (specifying the signing algorithm and token type), a payload (the actual claims, like userId and role), and a signature (computed over the header and payload using a secret or private key, allowing the server to verify the token hasn't been tampered with).
const jwt = require('jsonwebtoken');

const token = jwt.sign({ userId: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });

// Verifying an incoming token
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET);
  req.user = decoded;
} catch (err) {
  return res.status(401).json({ error: 'Invalid or expired token' });
}
Real-world example A mobile app authenticates once against an API and stores the returned JWT locally, attaching it as a Bearer token on every subsequent request, letting the API verify the user's identity statelessly on each server instance without needing a shared session store at all.

Common follow-ups: Why is it critical to never store sensitive data like a password inside a JWT's payload, given the payload is only encoded, not encrypted?;How do you handle revoking a JWT before its natural expiration, given it's normally self-contained and stateless?

Authentication & Authorization (JWT OAuth Passport);Security
All 15 Authentication & Authorization questions