Practise vocabulary for JSON Web Tokens: header, payload, signature, standard claims, and token lifecycle operations.
0 / 15 completed
1 / 15
A JWT consists of three base64url-encoded parts separated by dots. In order, they are ___.
A JWT has three parts: Header (algorithm and token type), Payload (claims), and Signature (verification). They're separated by dots: xxxxx.yyyyy.zzzzz.
2 / 15
The JWT claim 'exp' stands for ___, and its value is a Unix timestamp.
'exp' (Expiration Time) is a registered JWT claim that specifies when the token expires. Tokens with past exp values must be rejected.
3 / 15
The JWT claim 'sub' identifies ___.
'sub' (Subject) identifies the principal the JWT is about — typically a user ID. It's used to identify the entity on whose behalf the token was issued.
4 / 15
Token ___ is the process of exchanging an expired access token for a new one using a long-lived token.
Token refresh uses a refresh token (long-lived) to obtain a new access token without requiring the user to log in again. Access tokens are short-lived; refresh tokens are longer-lived.
5 / 15
Storing JWTs in ___ is considered more secure than localStorage because it is inaccessible to JavaScript.
HttpOnly cookies cannot be accessed by JavaScript, protecting against XSS attacks. localStorage is vulnerable to XSS — any script on the page can steal tokens stored there.
6 / 15
During a code review of the authentication service, Alice comments: 'I noticed you're using a JWT for session management. Could you elaborate on how the `nbf` claim is being utilized to ensure tokens are only valid after a specific time window?'
The `nbf` (Not Before) JWT claim defines the earliest time at which a token will be valid. It's crucial for scenarios where you need to enforce a period during which a token is unusable before its expiration. Using it correctly prevents tokens from being prematurely activated, enhancing security and preventing misuse.
7 / 15
Bob sends a Slack message to the team: 'Just deployed the new user onboarding flow. We're now using JWTs for all API requests related to user profiles. Remember that each token has an `aud` claim – it specifies the intended audience or application for that specific token.'
The `aud` (Audience) JWT claim identifies the intended recipient or application that is authorized to use the token. This allows for granular control and prevents tokens from being misused by unintended applications, improving security. It's a key component of limiting potential vulnerabilities.
8 / 15
The API returns the following JSON response after a successful authentication request:
The response body of a JWT-based authentication is a JSON object containing various claims. These claims (like `sub`, `iss`, `exp`) provide information about the user and the token itself – essential for verifying identity and authorizing access to resources. The provided example demonstrates this structure.
9 / 15
In a pull request description, David writes: 'This change implements JWT token refresh functionality using the 'refresh_token' flow. The server will issue a new access token when the existing one expires, leveraging the `iss` claim to verify the refreshing party.'
The `iss` (Issuer) JWT claim identifies the entity that issued the token. This is a critical security measure as it allows the receiving application to verify the authenticity of the issuer and prevent man-in-the-middle attacks. It's how the server knows who authorized the refresh token.
10 / 15
During the daily standup, Emily says: 'I'm working on securing our user profiles with JWTs. I've stored them in a dedicated Redis cache using a key based on the user ID and token value to prevent direct access via JavaScript.'
Storing JWTs in an encrypted in-memory database like Redis (or similar) significantly improves security compared to storing them directly in browser storage (localStorage or sessionStorage). This prevents client-side JavaScript from accessing the raw token data, mitigating risks of theft and manipulation. The key structure is a good start but doesn't replace encryption.
11 / 15
During a code review of the authentication service, Alice comments: 'I noticed you're using a JWT for session management. Could you elaborate on how the `nbf` claim is being utilized to ensure tokens are only valid after a specific time window?'
The `nbf` (Not Before) JWT claim defines the earliest time at which a token will be valid. It's crucial for scenarios where you need to enforce a period during which a token is unusable before its expiration. Using it correctly prevents tokens from being prematurely activated, enhancing security and preventing misuse.
12 / 15
Bob sends a Slack message to the team: 'Just deployed the new user onboarding flow. We're now using JWTs for all API requests related to user profiles. Remember that each token has an `aud` claim – it specifies the intended audience or application for that specific token.'
The `aud` (Audience) JWT claim identifies the intended recipient or application that is authorized to use the token. This allows for granular control and prevents tokens from being misused by unintended applications, improving security. It's a key component of limiting potential vulnerabilities.
13 / 15
The API returns the following JSON response after a successful authentication request:
The response body of a JWT-based authentication is a JSON object containing various claims. These claims (like `sub`, `iss`, `exp`) provide information about the user and the token itself – essential for verifying identity and authorizing access to resources. The provided example demonstrates this structure.
14 / 15
In a pull request description, David writes: 'This change implements JWT token refresh functionality using the 'refresh_token' flow. The server will issue a new access token when the existing one expires, leveraging the `iss` claim to verify the refreshing party.'
The `iss` (Issuer) JWT claim identifies the entity that issued the token. This is a critical security measure as it allows the receiving application to verify the authenticity of the issuer and prevent man-in-the-middle attacks. It's how the server knows who authorized the refresh token.
15 / 15
During the daily standup, Emily says: 'I'm working on securing our user profiles with JWTs. I've stored them in a dedicated Redis cache using a key based on the user ID and token value to prevent direct access via JavaScript.'
Storing JWTs in an encrypted in-memory database like Redis (or similar) significantly improves security compared to storing them directly in browser storage (localStorage or sessionStorage). This prevents client-side JavaScript from accessing the raw token data, mitigating risks of theft and manipulation. The key structure is a good start but doesn't replace encryption.
What will I practise in "JWT Structure & Token Lifecycle Language"?
Practise vocabulary for JSON Web Tokens: header, payload, signature, standard claims, and token lifecycle operations.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.