DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Node.js Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Node.js
A team stores an internal API signing key directly inside a JWT payload issued to end users, reasoning that since the JWT is signed, its contents are protected. What's the flaw in this reasoning?
A
There's no flaw, this is safe
B
Signing prevents TAMPERING, not READING — any end user can base64-decode the payload and see the internal signing key in plaintext
C
JWTs cannot contain arbitrary keys
D
The flaw is unrelated to confidentiality
Check Answer