Permission middleware in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without permission accesses the route?

Consider this Express middleware that checks user permissions before allowing access to a route.

function checkPermission(permission) {
  return (req, res, next) => {
    if (req.user?.permissions?.includes(permission)) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

app.get('/admin', checkPermission('admin'), (req, res) => {
  res.send('Welcome Admin');
});

What will the server respond if a user without the 'admin' permission tries to access '/admin'?

A The server responds with status 403 and message 'Forbidden'.

B The server responds with status 200 and message 'Welcome Admin'.

C The server responds with status 404 because the route is not found.

D The server crashes with a TypeError because req.user is undefined.

💡 Hint

Look at the middleware logic and what happens when the permission is missing.

The middleware checks if the user has the required permission. If not, it sends a 403 Forbidden response. So users without 'admin' permission get blocked.

📝 Syntax

intermediate

Which middleware syntax correctly checks for multiple permissions?

You want to create middleware that allows access if the user has any of the given permissions.

Which option correctly implements this?

A

function checkAnyPermission(permissions) {
  return (req, res, next) => {
    if (permissions.find(p => req.user.permissions.includes(p))) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

B

function checkAnyPermission(permissions) {
  return (req, res, next) => {
    if (permissions.every(p => req.user.permissions.includes(p))) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

C

function checkAnyPermission(permissions) {
  return (req, res, next) => {
    if (req.user.permissions.includes(permissions)) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

D

function checkAnyPermission(permissions) {
  return (req, res, next) => {
    if (permissions.some(p => req.user.permissions.includes(p))) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

💡 Hint

Use an array method that returns true if at least one element matches.

some() returns true if any permission matches. every() requires all permissions, which is not what we want here.

🔧 Debug

advanced

Why does this permission middleware cause a crash?

Look at this middleware code:

function checkPermission(permission) {
  return (req, res, next) => {
    if (req.user.permissions.includes(permission)) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

Sometimes the server crashes with TypeError: Cannot read property 'includes' of undefined. Why?

A Because <code>req.user</code> or <code>req.user.permissions</code> can be undefined if the user is not authenticated.

B Because <code>permission</code> is not a string.

C Because <code>next()</code> is not called properly.

D Because <code>res.status(403).send()</code> is missing a return statement.

💡 Hint

Think about what happens if the user is not logged in.

If req.user or req.user.permissions is undefined, calling includes causes a TypeError. The middleware should check these exist first.

❓ state_output

advanced

What is the response when middleware calls next() twice?

Consider this middleware:

function checkPermission(permission) {
  return (req, res, next) => {
    if (req.user?.permissions?.includes(permission)) {
      next();
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

What happens when a user with the permission accesses the route?

A The server sends two responses causing a network error.

B The server responds normally with the route handler output.

C The server throws an error because next() is called multiple times.

D The server ignores the second next() call silently.

💡 Hint

Calling next() more than once in Express middleware is problematic.

Express throws an error if next() is called multiple times in the same middleware chain because it confuses the request flow.

🧠 Conceptual

expert

How to design permission middleware for asynchronous user data loading?

You want to create permission middleware but user permissions are loaded asynchronously from a database.

Which approach correctly handles this in Express?

A Load permissions outside middleware and store in a global variable for synchronous access.

B Make the middleware function async and use await to get permissions, then call next() or send response.

C Call next() immediately and check permissions later in the route handler.

D Use setTimeout to delay permission check inside middleware.

💡 Hint

Express supports async middleware functions that return promises.

Making middleware async and awaiting permission loading ensures the check completes before continuing. Other options cause race conditions or bad design.