Preflight requests behavior in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when an Express server receives a CORS preflight OPTIONS request?

Consider an Express server configured with CORS middleware. When the browser sends a preflight OPTIONS request, what is the typical server response behavior?

Express

const express = require('express');
const cors = require('cors');
const app = express();
app.use(cors());
app.options('*', cors());
app.get('/data', (req, res) => res.json({msg: 'Hello'}));
app.listen(3000);

A The server ignores OPTIONS requests and returns 404 Not Found.

B The server responds with status 200 and the JSON data from the GET /data route.

C The server responds with status 204 and appropriate CORS headers without calling other route handlers.

D The server responds with status 500 Internal Server Error due to missing OPTIONS handler.

💡 Hint

Think about how CORS middleware handles OPTIONS requests before other routes.

Express CORS middleware automatically handles preflight OPTIONS requests by sending a 204 No Content response with the correct CORS headers. It does not proceed to other route handlers.

📝 Syntax

intermediate

Which Express code snippet correctly handles CORS preflight requests for all routes?

Choose the code snippet that properly enables CORS preflight OPTIONS requests for every route in an Express app.

A app.use(cors()); app.options('*', cors());

B app.get('*', cors()); app.options('*', cors());

C app.use(cors()); app.get('*', cors());

D app.options('*', (req, res) => res.sendStatus(200));

💡 Hint

Remember that preflight requests use the OPTIONS method and need special handling.

Using app.use(cors()) enables CORS for all routes and methods. Adding app.options('*', cors()) ensures OPTIONS preflight requests are handled with proper CORS headers.

🔧 Debug

advanced

Why does this Express server fail to respond correctly to CORS preflight requests?

Examine the code below. The server does not respond properly to preflight OPTIONS requests, causing CORS errors in the browser. What is the main issue?

Express

const express = require('express');
const app = express();
app.get('/api', (req, res) => res.json({data: 'ok'}));
app.listen(3000);

A The GET route handler incorrectly responds to OPTIONS requests causing errors.

B The server uses express but does not import the http module.

C The server listens on port 3000 which is blocked by the browser.

D The server lacks CORS middleware and does not handle OPTIONS requests, so preflight fails.

💡 Hint

Think about what the browser expects before sending actual requests with custom headers.

Without CORS middleware, Express does not send the required CORS headers or handle OPTIONS preflight requests, so browsers block the request.

❓ state_output

advanced

What is the response status code for a successful CORS preflight request in Express with cors middleware?

Given an Express app using the cors middleware, what status code does the server send back for a successful OPTIONS preflight request?

Express

const express = require('express');
const cors = require('cors');
const app = express();
app.use(cors());
app.options('*', cors());
app.listen(3000);

A 204 No Content

B 200 OK

C 404 Not Found

D 500 Internal Server Error

💡 Hint

Preflight requests do not return data, only headers.

The CORS middleware responds to OPTIONS preflight requests with status 204 No Content, indicating success without a response body.

🧠 Conceptual

expert

Which header must the Express server include in the preflight response to allow credentials in CORS requests?

When handling CORS preflight OPTIONS requests, which response header must the Express server include to allow the browser to send credentials (cookies, HTTP auth) with cross-origin requests?

A Access-Control-Allow-Origin: *

B Access-Control-Allow-Credentials: true

C Access-Control-Allow-Methods: GET, POST, OPTIONS

D Access-Control-Allow-Headers: Content-Type

💡 Hint

Credentials require a specific header that cannot be wildcarded.

The Access-Control-Allow-Credentials: true header tells the browser it can include credentials in cross-origin requests. The origin cannot be '*'.