Middleware composition for auth layers in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when multiple auth middlewares are composed in Express?

Consider two middleware functions authA and authB used in sequence in an Express route. What will happen if authA calls next() without error, but authB sends a response and does not call next()?

Express

const authA = (req, res, next) => { console.log('authA'); next(); };
const authB = (req, res, next) => { console.log('authB'); res.status(401).send('Unauthorized'); };
app.get('/secure', authA, authB, (req, res) => { res.send('Welcome'); });

A An error is thrown because authB does not call next().

B Both middlewares run and then the final handler sends 'Welcome'.

C The response 'Unauthorized' is sent and the final handler is never called.

D The request hangs because authB neither calls next() nor ends the response.

💡 Hint

Think about what happens when a middleware sends a response and does not call next().

When authB sends a response and does not call next(), Express stops processing further middleware or handlers. So the final handler is never called, and the client receives the 'Unauthorized' response.

📝 Syntax

intermediate

Which middleware composition syntax correctly applies two auth middlewares in Express?

Given two middleware functions auth1 and auth2, which option correctly applies both to a route /dashboard so that auth1 runs before auth2?

A app.get('/dashboard', auth1 && auth2, (req, res) => { res.send('Dashboard'); });

B app.get('/dashboard', auth1, auth2, (req, res) => { res.send('Dashboard'); });

C app.get('/dashboard', [auth2, auth1], (req, res) => { res.send('Dashboard'); });

D app.get('/dashboard', auth1 || auth2, (req, res) => { res.send('Dashboard'); });

💡 Hint

Remember how Express accepts multiple middleware functions as separate arguments.

Express expects middleware functions as separate arguments or as an array. Option B correctly passes them as separate arguments in the desired order. Option B reverses the order, and options A and D use invalid JavaScript expressions.

🔧 Debug

advanced

Why does this composed auth middleware cause the request to hang?

Examine the following middleware composition. Why does the request to /profile never complete?

Express

const checkToken = (req, res, next) => { if (!req.headers.token) { res.status(401).send('No token'); } else { next(); } };
const verifyUser = (req, res, next) => { if (req.headers.token === 'valid') { next(); } else { res.status(401).send('Invalid token'); } };
app.get('/profile', checkToken, verifyUser, (req, res) => { res.send('User Profile'); });

A Because verifyUser does not call next() or send a response when token is invalid, causing the request to hang.

B Because checkToken sends a response and calls next(), causing double responses.

C Because the route handler is missing a response call.

D Because the middleware functions are in the wrong order.

💡 Hint

Look at all code paths in verifyUser and see if next() or res.send() is always called.

If verifyUser does not call next() or send a response when the token is invalid, Express waits indefinitely. This causes the request to hang.

❓ state_output

advanced

What is the value of req.user after this middleware composition?

Given these two middlewares, what will be the value of req.user in the final handler?

Express

const authA = (req, res, next) => { req.user = { id: 1, role: 'user' }; next(); };
const authB = (req, res, next) => { if (req.user.role === 'user') { req.user.permissions = ['read']; } next(); };
app.get('/data', authA, authB, (req, res) => { res.json(req.user); });

A {"id":1,"role":"user","permissions":["read"]}

B {"id":1,"role":"user"}

C undefined

D {"permissions":["read"]}

💡 Hint

Consider how req.user is modified by each middleware.

The first middleware sets req.user with id and role. The second adds a permissions array if the role is 'user'. So the final req.user has id, role, and permissions.

🧠 Conceptual

expert

Which statement best describes middleware composition for layered authentication in Express?

When building layered authentication with multiple middleware functions in Express, which statement is true about their composition and execution?

A Middleware functions can only be composed using arrays, not as separate arguments.

B Middleware functions run in parallel and the first to send a response ends the request.

C Middleware functions automatically merge their results into a single object passed to the final handler.

D Middleware functions run in the order they are declared; each must call next() to pass control, or send a response to end the chain.

💡 Hint

Think about how Express processes middleware functions sequentially.

Express executes middleware functions one after another in the order they are declared. Each middleware must call next() to continue or send a response to end the request. They do not run in parallel or automatically merge results.