Preflight requests behavior in Express - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to handle OPTIONS preflight requests in Express.

Express

app.[1]('/api/data', (req, res) => {
  res.sendStatus(204);
});

Drag options to blanks, or click blank then click option'

Aget

Bput

Cpost

Doptions

Attempts:

3 left

💡 Hint

Common Mistakes

Using GET or POST instead of OPTIONS for preflight requests.

The OPTIONS method is used to handle preflight requests in Express.

2fill in blank

medium

Complete the code to set the Access-Control-Allow-Origin header for CORS.

Express

app.use((req, res, next) => {
  res.setHeader('Access-Control-Allow-Origin', [1]);
  next();
});

Drag options to blanks, or click blank then click option'

A'*'

B'localhost'

C'GET'

D'application/json'

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTP methods or content types instead of origin values.

Setting Access-Control-Allow-Origin to '*' allows all origins to access the resource.

3fill in blank

hard

Fix the error in the code to allow specific methods in preflight response.

Express

app.options('/api/data', (req, res) => {
  res.setHeader('Access-Control-Allow-Methods', [1]);
  res.sendStatus(204);
});

Drag options to blanks, or click blank then click option'

A'GET, POST, DELETE'

B'*'

C'get, post, delete'

D'GET POST DELETE'

Attempts:

3 left

💡 Hint

Common Mistakes

Using space-separated methods or lowercase method names.

The header value must be a comma-separated list of allowed HTTP methods in uppercase.

4fill in blank

hard

Fill both blanks to allow credentials and specific headers in CORS preflight.

Express

app.use((req, res, next) => {
  res.setHeader('Access-Control-Allow-Credentials', [1]);
  res.setHeader('Access-Control-Allow-Headers', [2]);
  next();
});

Drag options to blanks, or click blank then click option'

A'true'

B'false'

C'Content-Type, Authorization'

D'X-Custom-Header'

Attempts:

3 left

💡 Hint

Common Mistakes

Using boolean true instead of string 'true' for credentials.

Listing headers without commas.

Allowing credentials requires 'true' as a string, and headers must be a comma-separated string.

5fill in blank

hard

Fill all three blanks to complete a middleware that handles CORS preflight requests properly.

Express

app.use((req, res, next) => {
  if (req.method === [1]) {
    res.setHeader('Access-Control-Allow-Origin', [2]);
    res.setHeader('Access-Control-Allow-Methods', [3]);
    res.sendStatus(204);
  } else {
    next();
  }
});

Drag options to blanks, or click blank then click option'

A'OPTIONS'

B'*'

C'GET, POST, PUT'

D'POST'

Attempts:

3 left

💡 Hint

Common Mistakes

Checking wrong HTTP method.

Using wrong header values or missing commas.

The middleware checks if the method is OPTIONS, then sets headers to allow all origins and specific methods.