Advanced Auth Patterns — Series 2

Preview — 3 of 10 questions

When does the asymmetric option become the right choice?

javascript

// (1)
JwtModule.register({ secret: process.env.JWT_SECRET });
// (2)
JwtModule.register({
  privateKey: readFileSync('private.pem'),
  publicKey: readFileSync('public.pem'),
  signOptions: { algorithm: 'RS256' },
});

AWhenever tokens must be larger than 4 kB, which HS256 cannot produce

BWhenever the token needs to be readable by the client, which HS256 prevents

CNever in practice — RS256 exists only for legacy interoperability

DWhen more than one party verifies tokens: with HS256 the same secret both signs and verifies, so every verifier could also mint tokens, while RS256 lets services hold only the public key and keeps signing authority with the issuer

What role does the token's kid header play here?

javascript

super({
  secretOrKeyProvider: passportJwtSecret({
    jwksUri: 'https://auth.example.com/.well-known/jwks.json',
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
  }),
  algorithms: ['RS256'],
});

AIt identifies the user, letting the provider look up the right account

BIt names which key from the JWKS document signed this token, so the verifier fetches the key set once, caches it, and selects the matching public key — which is what makes key rotation possible without redeploying every service

CIt carries the key itself, so no network fetch is needed

DIt encodes the token's expiry in a compact form

Why does the overlap period exist?

javascript

Day 0: key A signs and verifies.
Day 1: key B is published alongside A. New tokens are signed with B.
Day 8: key A is removed.

ABecause tokens already issued and signed with key A stay valid until they expire, so the verifier must accept both keys until every A-signed token has aged out — removing A immediately would reject legitimate, unexpired tokens

BBecause clients need time to download key B before they can send requests

CBecause a JWKS document may contain at most one key at a time

DBecause RS256 requires a week-long handshake to establish a new key pair

Answer all 10 questions (7 more), see explanations for every answer, and track your score.