JWT Token Testing: Structure, Expiry, Tampering, Refresh and Logout

JWTs (JSON Web Tokens) keep you logged in to almost every modern app, from food delivery to banking. They also cause some of the most serious API vulnerabilities: tokens that never expire, signatures that aren’t checked, and logouts that don’t really log you out. In this lesson you’ll take a real JWT apart, then test expiry, tampering, refresh rotation and logout on the live practice API, manually and with Playwright.

What Is a JWT? (The Cinema Wristband Example)

Because the server can verify the signature with its secret key, it doesn’t need to look up a session in a database on every request. That’s why JWTs are called stateless tokens.

Anatomy of a Real JWT

Log in to the practice API and you get an access_token like this (shortened):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczpcL1wvc3FhdG9vbHMuaW5cLyIsInN1YiI6ImFkbWluIiwi...fQ._ZDcTiyS-183vQ2eAI_zeSnPgZMdX2Z3IYBrifVfyiM
<------------- header ------------->.<-------------------- payload -------------------->.<-------- signature -------->

Decoding the first two parts (Base64URL) shows:

// Header
{ "alg": "HS256", "typ": "JWT" }

// Payload (claims)
{
  "iss": "https://sqatools.in/",   // issuer
  "sub": "admin",                  // subject: the user
  "name": "Admin User",
  "role": "admin",                 // custom claim used for authorization
  "iat": 1794482821,               // issued at (Unix seconds)
  "exp": 1794483721,               // expires at: iat + 900 s
  "jti": "2hqtst3pmbas36wm"        // unique token id (used for revocation)
}

The third part is the signature: HMACSHA256(base64url(header) + "." + base64url(payload), secret). Change one character of the header or payload and the signature no longer matches.

Standard claims to check

The Token Lifecycle on the Practice API

Start by logging in here, then copy the access_token into Postman or the cURL commands below:

curl -i \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin@123"}' \
  "https://sqatools.in/wp-json/sqa-api/v1/auth/login"

You can also request a shorter lifetime for expiry testing: send "expires_in": 5 in the login body (allowed range 5 to 3600 seconds; 3 returns 422).

JWT Test Cases (Complete List)

Testing Tampering Step by Step

1. Log in as viewer / viewer@123 and copy the token.
2. Split it at the dots. Base64URL-decode the middle part.
3. Change "role":"viewer" to "role":"admin", encode it again (Base64URL, no padding).
4. Rebuild header.newPayload.originalSignature and call GET /auth/me.
5. Pass if the response is 401 (“Token signature is not valid”). Critical bug if it returns 200 with role admin.

# Quick signature tamper with cURL (replace TOKEN). Changing the last 2 characters breaks the signature.
TAMPERED="${TOKEN%??}AA"
curl -i https://sqatools.in/wp-json/sqa-api/v1/auth/me -H "Authorization: Bearer $TAMPERED"
# HTTP/1.1 401 ... "Token signature is not valid (was the token changed?)."

Testing Expiry Without Waiting 15 Minutes

Real access tokens may live 15 to 60 minutes. Waiting is slow, so testers use one of these:

• A test-only short lifetime, like the practice API’s expires_in field.
• A configuration flag in the test environment that sets token lifetime to seconds.
• An already-expired token saved from a previous run (works as long as the signing key hasn’t changed).
• Unit tests on the token validator with a fake clock (developer level).

Also test clock skew: servers usually allow 30 to 60 seconds of tolerance; a token expired an hour ago must fail.

Refresh Tokens and Rotation

Short access tokens are safer, but users don’t want to log in every 15 minutes. A refresh token (long-lived, stored securely) gets new access tokens silently. With rotation, every refresh returns a new refresh token and invalidates the old one. If an attacker steals a refresh token and the real app also uses it, the reuse is detected.

Refresh tests: refresh works once; reuse returns 401; a refresh token can’t be used as an access token (and vice versa); logout and password change revoke refresh tokens; refresh tokens have their own maximum lifetime.

JWT Testing in Postman

1. Send POST /auth/login. In the Scripts → Post-response tab add:

   pm.test('login ok', () => pm.response.to.have.status(200));
   const body = pm.response.json();
   pm.environment.set('access_token', body.access_token);
   pm.environment.set('refresh_token', body.refresh_token);

2. On GET /auth/me, set Authorization → Bearer Token to {{access_token}}.
3. Duplicate the request, change the token to {{access_token}}x and assert 401.

Full Postman scripting is in Postman Tests and Newman.

JWT Tests in Playwright (TypeScript)

import { test, expect, APIRequestContext } from '@playwright/test';

const BASE = 'https://sqatools.in/wp-json/sqa-api/v1';

async function login(request: APIRequestContext, user = 'admin', pass = 'admin@123', expires_in?: number) {
  const res = await request.post(`${BASE}/auth/login`, { data: { username: user, password: pass, expires_in } });
  expect(res.status()).toBe(200);
  return res.json() as Promise<{ access_token: string; refresh_token: string; expires_in: number }>;
}
const bearer = (t: string) => ({ Authorization: `Bearer ${t}` });
const decode = (t: string) => JSON.parse(Buffer.from(t.split('.')[1], 'base64url').toString());

test('payload has expected claims and no secrets', async ({ request }) => {
  const { access_token } = await login(request);
  const claims = decode(access_token);
  expect(claims).toMatchObject({ sub: 'admin', role: 'admin', iss: 'https://sqatools.in/' });
  expect(claims.exp - claims.iat).toBe(900);
  expect(JSON.stringify(claims)).not.toContain('admin@123');
});

test('forged role in payload is rejected', async ({ request }) => {
  const { access_token } = await login(request, 'viewer', 'viewer@123');
  const [h, p, s] = access_token.split('.');
  const forged = Buffer.from(JSON.stringify({ ...decode(access_token), role: 'admin' })).toString('base64url');
  const res = await request.get(`${BASE}/auth/me`, { headers: bearer(`${h}.${forged}.${s}`) });
  expect(res.status()).toBe(401);
});

test('expired token is rejected', async ({ request }) => {
  test.setTimeout(30_000);
  const { access_token } = await login(request, 'admin', 'admin@123', 5);
  await new Promise(r => setTimeout(r, 7_000));
  expect((await request.get(`${BASE}/auth/me`, { headers: bearer(access_token) })).status()).toBe(401);
});

test('refresh token rotates and works only once', async ({ request }) => {
  const { refresh_token } = await login(request);
  expect((await request.post(`${BASE}/auth/refresh`, { data: { refresh_token } })).status()).toBe(200);
  expect((await request.post(`${BASE}/auth/refresh`, { data: { refresh_token } })).status()).toBe(401);
});

test('logout revokes the access token', async ({ request }) => {
  const { access_token } = await login(request);
  expect((await request.post(`${BASE}/auth/logout`, { headers: bearer(access_token) })).status()).toBe(204);
  expect((await request.get(`${BASE}/auth/me`, { headers: bearer(access_token) })).status()).toBe(401);
});

JWT Security Checklist

• Signature always verified; alg: none and algorithm switching (RS256 → HS256) rejected.
• Strong secret; tokens from other environments rejected.
• Short exp; expiry enforced; refresh tokens rotated.
• Logout, password change and role change take effect.
• No sensitive data in the payload.
• Authorization decisions use server data or verified claims, never values sent by the client in the body.
• Tokens stored safely on clients (HttpOnly cookies or secure mobile storage).

Interview Questions: JWT Testing