Passport & JWT Basics — Series 2

Preview — 3 of 10 questions

Why is the password hashed rather than encrypted or stored as-is?

javascript

async register(dto: RegisterDto) {
  const passwordHash = await bcrypt.hash(dto.password, 10);
  return this.usersRepo.create({ email: dto.email, passwordHash });
}

ABecause encryption is slower than hashing for short strings

BBecause a password hash is deliberately one-way and salted — the server never needs the original value, only the ability to check a candidate against the stored hash, so a database leak does not hand an attacker usable credentials

CBecause the database rejects columns containing plaintext passwords

DBecause hashing compresses the value, saving storage

What does this structure tell you about the payload?

javascript

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMiLCJyb2xlIjoiYWRtaW4ifQ.T2xL...

AIt is encrypted with the signing secret and unreadable without it

BIt is compressed, so its contents cannot be recovered

CIt is a random identifier that the server exchanges for the real data

DIt is base64url-encoded, not encrypted — anyone holding the token can decode and read the claims; the signature only proves the token has not been altered

What does expiresIn do?

javascript

JwtModule.register({
  secret: process.env.JWT_SECRET,
  signOptions: { expiresIn: '15m' },
});

AIt writes an exp claim into every signed token, and verification rejects the token once that moment has passed — bounding how long a leaked token remains useful

BIt keeps the token valid for 15 minutes of inactivity, resetting on each request

CIt configures how long Nest caches the verification result

DIt has no effect unless a refresh-token flow is also implemented

Answer all 10 questions (7 more), see explanations for every answer, and track your score.