Interview Q&A / Node.js

1. Is the payload of a JWT encrypted, and what should you not put in it?

   No. The payload is only base64url encoded, so anyone holding the token can read it. Keep it small and non-sensitive: user id, role, expiry. Never put passwords, card details or personal secrets in it.

   BeginnerQuick answer1 min read
2. What are the three parts of a JWT?

   A JWT has a header (algorithm and type), a payload (claims such as user id and expiry), and a signature. They are base64url-encoded and joined with dots. The signature proves the token was not changed.

   BeginnerQuick answer1 min read
3. Write an Express middleware that checks a JWT and protects a route.

   Read the Bearer token from the Authorization header, verify it with jwt.verify, attach the claims to req.user and call next. On a missing or invalid token, respond 401 without calling next.

   BeginnerQuick answerCoding1 min read
4. What is a refresh token and why use it alongside a short-lived access token?

   The access token is short-lived (minutes) and sent on every request. The refresh token is long-lived, stored safely and used only to get a new access token. A stolen access token then expires quickly, and refresh tokens can be revoked.

   IntermediateQuick answer1 min read
5. What is the difference between session-based authentication and JWT authentication?

   Sessions store user state on the server and give the browser only a session id cookie. JWTs carry signed user claims in the token itself, so the server stores nothing, but revoking a token before it expires is harder.

   IntermediateQuick answer1 min read
6. Where should a browser app store a JWT: localStorage or an httpOnly cookie?

   An httpOnly, Secure, SameSite cookie keeps the token out of reach of JavaScript, so an XSS bug cannot steal it, but you must then handle CSRF. localStorage is simple but readable by any script on the page.

   IntermediateQuick answer1 min read