Protecting routes with auth middleware in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without a valid token accesses a protected route?

Consider this Express middleware that checks for a token in the request headers before allowing access to a route.

function authMiddleware(req, res, next) {
  const token = req.headers['authorization'];
  if (!token) {
    return res.status(401).send('Access denied. No token provided.');
  }
  next();
}

app.get('/dashboard', authMiddleware, (req, res) => {
  res.send('Welcome to your dashboard');
});

What will the server respond if a request to /dashboard has no authorization header?

A The server crashes with an error because token is undefined

B The server responds with status 200 and message 'Welcome to your dashboard'

C The server responds with status 401 and message 'Access denied. No token provided.'

D The server responds with status 403 and message 'Forbidden'

💡 Hint

Think about what the middleware does when the token is missing.

The middleware checks if the token exists. If it doesn't, it sends a 401 status with a message and does not call next(). So the route handler is never reached.

📝 Syntax

intermediate

Identify the syntax error in this auth middleware

Look at this Express middleware code meant to protect routes:

function auth(req, res, next) {
  const token = req.headers.authorization
  if (!token) {
    res.status(401).send('Unauthorized')
  } else {
    next()
  }
}

What is the syntax error that will cause this code to fail?

A Missing semicolon after <code>const token = req.headers.authorization</code>

B Missing <code>return</code> before <code>res.status(401).send(...)</code> causing response to continue

C Missing parentheses in <code>next</code> call

D No syntax error; code is valid

💡 Hint

Check if the code syntax matches JavaScript rules.

JavaScript does not require semicolons strictly, and calling next() with parentheses is correct. The code has no syntax errors.

🔧 Debug

advanced

Why does this auth middleware allow access without a token?

Review this middleware:

function authMiddleware(req, res, next) {
  const token = req.headers['authorization'];
  if (token) {
    next();
  }
  res.status(401).send('Unauthorized');
}

What is the problem with this code?

A It always sends 401 after calling next(), causing headers to be sent twice

B It never calls next(), so requests hang

C It allows access even without a token because next() is always called

D It throws a runtime error because res.status is undefined

💡 Hint

Consider what happens after next() is called.

The middleware calls next() if token exists, but then continues to send a 401 response anyway. This causes an error because the response is sent twice.

❓ state_output

advanced

What is the value of req.user after this auth middleware runs?

Given this middleware that verifies a token and adds user info:

function authMiddleware(req, res, next) {
  const token = req.headers['authorization'];
  if (!token) {
    return res.status(401).send('No token');
  }
  // Simulate token verification
  if (token === 'valid-token') {
    req.user = { id: 123, name: 'Alice' };
    next();
  } else {
    res.status(403).send('Invalid token');
  }
}

What will req.user be inside the route handler if the request header authorization is valid-token?

A Throws an error because req.user is not set

B { id: 123, name: 'Alice' }

C null

D undefined

💡 Hint

Look at where req.user is assigned.

If the token matches 'valid-token', the middleware sets req.user to the user object before calling next(). So the route handler can access it.

🧠 Conceptual

expert

Which option correctly protects multiple routes with the same auth middleware?

You want to protect these routes so only authenticated users can access them:

app.get('/profile', authMiddleware, (req, res) => { res.send('Profile page'); });
app.get('/settings', authMiddleware, (req, res) => { res.send('Settings page'); });

Which approach is best to avoid repeating authMiddleware on every route?

A Define a new router, apply <code>authMiddleware</code> to it, then mount the router for those routes

B Use <code>app.use(authMiddleware)</code> before defining the routes to apply it globally

C Wrap each route handler in a function that calls <code>authMiddleware</code> manually

D Add <code>authMiddleware</code> only to the first route; others inherit it automatically

💡 Hint

Think about grouping routes and applying middleware efficiently.

Using a router with authMiddleware applied once is a clean way to protect multiple routes without repeating middleware on each route. app.use(authMiddleware) applies middleware globally, which may be too broad.