CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
A JWT is sent in the Authorization header. An attacker intercepts it and inspects the payload. What data is visible?
- A.All claims in the payload (user ID, roles, email, expiry, etc.) are visible since the payload is only Base64url-encoded, not encrypted, unless a JWE (JSON Web Encryption) token is used
- B.Nothing; JWTs are encrypted by default
- C.Only the algorithm and header are visible
- D.The payload is hashed and cannot be decoded
Why A is correct
Standard JWTs (JWS - JSON Web Signature) encode the header and payload with Base64url, providing no confidentiality. Anyone who captures the token can decode and read all claims. Do not put sensitive data (PII, SSNs) in JWT payloads unless using JWE (JSON Web Encryption). The signature only ensures integrity and authenticity, not confidentiality.
Know someone studying for Web App Fundamentals? Send them this one.