Faz parte do material de Security que eu montei a partir das minhas entrevistas. Abaixo, a resposta em inglês e, quando existe, a pegadinha mais comum.
JSON Web Token is a claims format that can be signed and/or encrypted. A signed-only compact JWS has header.payload.signature. Its payload is readable, so a valid signature provides integrity rather than confidentiality.
Verification must check the allowed algorithm and trusted key, issuer, audience, expiry, and other required claims. Decoding the payload is not verification. A valid token still needs authorization for the requested object and action.
Short-lived access tokens limit exposure. Refresh tokens need a separate lifecycle, secure storage, and an appropriate rotation or sender-constraining policy.
An HttpOnly cookie prevents page JavaScript from reading it, but XSS can still issue authenticated requests. Use Secure, an appropriate SameSite policy, and CSRF defenses for cookie authentication.
Trap: a self-contained token remains usable until expiry if verifiers only check its signature and time claims. Selective early revocation requires an additional policy/state check, such as a session version or denylist. Removing a signing key can invalidate many tokens, but is a broad operational action, not selective logout.
Sources: JWT security best practices and OWASP cookie guidance.
Essa pergunta tem uma armadilha que derruba muita gente em entrevista. Ela está marcada na resposta acima: vale reler antes de treinar.
Ler é o primeiro passo. No app, essa pergunta vira flashcard com repetição espaçada, e o módulo tem quiz e simulado para testar o que ficou.
Treinar essa pergunta no app