Knowledge check
10 questions testing what you just read — no login, no tracking, just immediate feedback.
What does a JWT's signature actually protect?
What makes the "algorithm confusion" attack against JWTs possible?
Compared to an opaque session token, what's a key limitation of JWTs?
How many segments does a JWT have, and how are they separated?
What encoding is used for a JWT's header and payload segments?
What signing algorithms can a JWT use?
What was the "alg: none" JWT vulnerability?
What's a key advantage an opaque session token has over a JWT?
Which JWT claim is responsible for limiting how long a token remains valid?
Why should secrets never be placed in a JWT payload?