What is true about a JWT?
QuizMediumAsked in: Accenture, Capgemini, Infosys
An API returns a JWT after login and expects it as a Bearer token. Which statements are true? Choose all that apply.
- It has three base64url-encoded parts separated by dots: header, payload and signature
- Anyone holding the token can decode and read the payload, so it must not contain secrets
- If someone edits the payload (for example changes the role to admin), the signature check on the server fails
- The exp claim (the expiry time stored in the token) is optional decoration; servers ignore it
This question is part of Pro+
Pro+ opens every question in Interview Prep and the mock interview. Every article and the first 2 questions of each topic stay free. Hands-on Selenium and API tasks follow their course lesson's own lock.