Skip to content
QuiznExam

Node.js Authentication & JWT Quiz – 20 Questions with Answers

Test your knowledge of authentication and JSON Web Tokens in Node.js with 20 questions covering login flows, JWT structure, signing and verification, access tokens, refresh tokens, password hashing, cookies, middleware, authorization, and security best practices.

20
Questions
15 min
Time limit
Medium
Difficulty

No sign-up needed · Last updated:

Save your score

At least 8 characters.

Forgot password?

Related quizzes

All 15 questions and answers Spoilers: this shows the questions and answers. Try the quiz first! Open

  1. 1. What is the primary purpose of authentication in a Node.js application?

    • A. To determine what a user is allowed to access
    • B. To verify the identity of a user
    • C. To compress HTTP responses
    • D. To create database tables
    Show answer

    B. To verify the identity of a user

    Authentication verifies who a user or client is. Authorization determines what that authenticated user is allowed to access.

  2. 2. What does JWT stand for?

    • A. Java Web Token
    • B. JSON Web Token
    • C. JavaScript Web Transfer
    • D. JSON Web Transfer
    Show answer

    B. JSON Web Token

    JWT stands for JSON Web Token and is a compact format for securely transmitting claims between parties.

  3. 3. Which three parts make up a typical JWT?

    • A. Header, Payload, Signature
    • B. Username, Password, Token
    • C. Request, Response, Session
    • D. Header, Body, Cookie
    Show answer

    A. Header, Payload, Signature

    A JWT normally consists of a header, payload, and signature, separated by periods.

  4. 4. What information is commonly stored in the JWT payload?

    • A. Claims about the token or subject
    • B. The user's plaintext password
    • C. The server's private key
    • D. The complete database
    Show answer

    A. Claims about the token or subject

    The payload contains claims such as subject identifiers, issuer information, expiration time, and application-specific data. It should not contain sensitive secrets such as plaintext passwords.

  5. 5. Is the payload of a normal JWT encrypted by default?

    • A. Yes, always
    • B. No, it is typically encoded rather than encrypted
    • C. Only when using HTTPS
    • D. Only when stored in a cookie
    Show answer

    B. No, it is typically encoded rather than encrypted

    A standard signed JWT provides integrity and authenticity but does not hide its payload. Sensitive information should not be placed in the payload unless an appropriate encryption mechanism is used.

  6. 6. What is the purpose of the signature in a JWT?

    • A. To verify that the token has not been altered and was signed by a trusted party
    • B. To encrypt the payload
    • C. To store the user's password
    • D. To increase the token size
    Show answer

    A. To verify that the token has not been altered and was signed by a trusted party

    The JWT signature is used to verify the integrity and authenticity of the signed token.

  7. 7. Which HTTP header is commonly used to send a JWT access token to an API?

    • A. Authorization
    • B. Authentication
    • C. Token
    • D. JWT-Token
    Show answer

    A. Authorization

    A common pattern is to send the token in the Authorization header using the Bearer scheme.

  8. 8. Which format is commonly used when sending a JWT in the Authorization header?

    • A. Authorization: JWT <token>
    • B. Authorization: Bearer <token>
    • C. Authorization: Token <password>
    • D. Authorization: Basic <token>
    Show answer

    B. Authorization: Bearer <token>

    Bearer authentication commonly uses the format Authorization: Bearer followed by the access token.

  9. 9. Which operation should a Node.js server perform when receiving a JWT from a client?

    • A. Decode it and trust the payload immediately
    • B. Verify its signature and relevant claims
    • C. Store it as the user's password
    • D. Change the token before every request
    Show answer

    B. Verify its signature and relevant claims

    A server should verify the token's signature and validate relevant claims such as expiration, issuer, audience, and subject as appropriate.

  10. 10. What is the purpose of an access token in a JWT-based authentication system?

    • A. To provide temporary credentials for accessing protected resources
    • B. To permanently store a user's password
    • C. To replace the database
    • D. To encrypt every HTTP request
    Show answer

    A. To provide temporary credentials for accessing protected resources

    An access token represents authorization to access protected resources and is commonly configured with a relatively short lifetime.

  11. 11. What is the typical purpose of a refresh token?

    • A. To obtain a new access token without requiring the user to log in again
    • B. To replace password hashing
    • C. To store API response data
    • D. To make an access token readable
    Show answer

    A. To obtain a new access token without requiring the user to log in again

    A refresh token can be used by an authentication system to issue a new access token after the current access token expires, subject to server-side validation and policy.

  12. 12. Which practice is appropriate for storing user passwords in a Node.js application?

    • A. Store plaintext passwords
    • B. Store passwords using a password-hashing algorithm
    • C. Store passwords directly inside JWT payloads
    • D. Encode passwords with Base64
    Show answer

    B. Store passwords using a password-hashing algorithm

    Passwords should be stored using a dedicated password-hashing algorithm such as Argon2id or bcrypt rather than plaintext or reversible encoding.

  13. 13. Why is Base64 encoding not an appropriate method for protecting passwords?

    • A. Base64 is reversible and is not a password-hashing algorithm
    • B. Base64 always produces invalid strings
    • C. Base64 can only encode numbers
    • D. Base64 automatically exposes database credentials
    Show answer

    A. Base64 is reversible and is not a password-hashing algorithm

    Base64 is an encoding scheme, not a security mechanism. Encoded data can easily be decoded.

  14. 14. Which cookie attribute helps prevent client-side JavaScript from reading an authentication cookie?

    • A. HttpOnly
    • B. Readable
    • C. Public
    • D. JavaScriptAccess
    Show answer

    A. HttpOnly

    The HttpOnly cookie attribute prevents browser scripts from accessing the cookie through APIs such as document.cookie.

  15. 15. Which cookie attribute instructs the browser to send a cookie only over HTTPS connections?

    • A. Secure
    • B. HttpsOnly
    • C. Encrypted
    • D. Private
    Show answer

    A. Secure

    The Secure attribute tells the browser to send the cookie only over secure HTTPS connections, subject to browser behavior and context.

  16. 16. What does the exp claim in a JWT commonly represent?

    • A. The token's expiration time
    • B. The user's password
    • C. The encryption key
    • D. The server's IP address
    Show answer

    A. The token's expiration time

    The exp registered claim identifies the time after which the JWT should no longer be accepted.

  17. 17. What is authorization in a JWT-based Node.js application?

    • A. Determining whether an authenticated user has permission to perform an action
    • B. Checking whether a password exists in the database
    • C. Generating a random JWT string
    • D. Encoding the JWT payload
    Show answer

    A. Determining whether an authenticated user has permission to perform an action

    Authorization determines what an authenticated identity is permitted to access or do.

  18. 18. What is a common way to protect multiple Express routes that require authentication?

    • A. Authentication middleware
    • B. CSS middleware
    • C. Database comments
    • D. HTML attributes
    Show answer

    A. Authentication middleware

    Authentication middleware can extract credentials, verify a JWT, and attach the authenticated identity to the request before protected route handlers execute.

  19. 19. Why should a JWT signing secret or private key be kept out of source code?

    • A. To prevent unauthorized parties from obtaining credentials needed to forge or validate tokens
    • B. Because Node.js cannot read strings from source files
    • C. Because JWTs cannot contain signatures
    • D. Because environment variables are required by JavaScript syntax
    Show answer

    A. To prevent unauthorized parties from obtaining credentials needed to forge or validate tokens

    Signing credentials are sensitive secrets. They should be protected through appropriate secret-management mechanisms rather than being committed directly to source control.

  20. 20. Which statement best describes the difference between authentication and authorization?

    • A. Authentication verifies identity, while authorization determines permitted access
    • B. Authentication determines permissions, while authorization verifies identity
    • C. Both terms always mean exactly the same thing
    • D. Authentication is only used for databases
    Show answer

    A. Authentication verifies identity, while authorization determines permitted access

    Authentication answers who the user is, while authorization determines what that authenticated user is allowed to access or perform.