Node.js · Middle · Question 38 of 75

What does a JWT signature guarantee?

1That the token can be revoked at any time
2That the payload is encrypted and unreadable
✓Correct answer: That the token was issued by someone with the key and wasn't changed; it does NOT hide the payload

Explanation

The payload is only Base64URL-encoded, so don't put secrets in it. Always verify the signature with a fixed algorithm list and check exp.

Further reading

Test yourself

Take the Node.js · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.