200-901 Practice Question: Refer to the exhibit

from flask import Flask, request, jsonify
import jwt

app = Flask(__name__)
app.config['SECRET_KEY'] = 'my-secret'

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username')
    password = request.json.get('password')
    # Verify username/password (omitted)
    token = jwt.encode({'user': username}, app.config['SECRET_KEY'], algorithm='HS256')
    return jsonify({'token': token})

@app.route('/protected', methods=['GET'])
def protected():
    token = request.headers.get('Authorization')
    if not token:
        return jsonify({'msg': 'Missing token'}), 401
    try:
        # token format: "Bearer <token>"
        token = token.split()[1]
        data = jwt.decode(token, app.config['SECRET_KEY'], algorithms=['HS256'])
        return jsonify({'msg': 'Access granted', 'user': data['user']})
    except:
        return jsonify({'msg': 'Invalid token'}), 401