Refresh token concept in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of a refresh token in an Express authentication flow?

Choose the best explanation for why refresh tokens are used alongside access tokens.

A To allow the client to get a new access token without asking the user to log in again.

B To store the user's password securely on the client side.

C To replace the access token permanently after it expires.

D To encrypt all API requests between client and server.

💡 Hint

Think about how users stay logged in without entering their password repeatedly.

Refresh tokens let the client ask the server for a new access token when the old one expires, so users don't have to log in again.

❓ component_behavior

intermediate

What happens when an expired access token is used with a valid refresh token in Express?

Given a client sends an expired access token and a valid refresh token to the server, what is the expected server behavior?

A The server rejects the request and asks the user to log in again.

B The server deletes both tokens and logs the user out immediately.

C The server ignores the refresh token and processes the request with the expired token.

D The server issues a new access token and allows the request to proceed.

💡 Hint

Refresh tokens are meant to help when access tokens expire.

The server uses the refresh token to create a new access token, so the user stays logged in without interruption.

📝 Syntax

advanced

Which Express middleware snippet correctly verifies a refresh token from cookies?

Select the code snippet that properly extracts and verifies a refresh token stored in cookies using jsonwebtoken.

Express

const jwt = require('jsonwebtoken');

function verifyRefreshToken(req, res, next) {
  // Your code here
}

A

const token = req.cookies.refreshToken;
jwt.verify(token, process.env.REFRESH_SECRET, (err, user) => {
  if (err) return res.sendStatus(403);
  req.user = user;
  next();
});

B

const token = req.headers['refresh-token'];
jwt.verify(token, process.env.ACCESS_SECRET, (err, user) => {
  if (err) return res.sendStatus(401);
  req.user = user;
  next();
});

C

const token = req.body.refreshToken;
jwt.decode(token, process.env.REFRESH_SECRET);
next();

D

const token = req.query.token;
jwt.verify(token, process.env.REFRESH_SECRET);
res.sendStatus(200);

💡 Hint

Refresh tokens are often stored in cookies and verified with the refresh secret.

Option A correctly reads the refresh token from cookies and verifies it with the refresh secret. It handles errors and calls next() properly.

❓ state_output

advanced

What is the output of this Express route when the refresh token is missing?

Consider this Express route snippet handling token refresh. What response does the client get if no refresh token cookie is sent?

Express

app.post('/refresh', (req, res) => {
  const refreshToken = req.cookies.refreshToken;
  if (!refreshToken) {
    return res.status(401).json({ message: 'No refresh token provided' });
  }
  // further logic omitted
});

A Status 200 with JSON {"accessToken": "newtoken"}

B Status 403 with JSON {"message": "Invalid token"}

C Status 401 with JSON {"message": "No refresh token provided"}

D Status 500 with JSON {"error": "Server error"}

💡 Hint

Check the condition when refreshToken is falsy.

The route returns a 401 Unauthorized status with a message if the refresh token is missing.

🔧 Debug

expert

Why does this Express refresh token route cause a runtime error?

Identify the cause of the runtime error in this refresh token route code snippet.

Express

app.post('/token', (req, res) => {
  const refreshToken = req.cookies.refreshToken;
  jwt.verify(refreshToken, process.env.REFRESH_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    const accessToken = jwt.sign({ name: user.name }, process.env.ACCESS_SECRET, { expiresIn: '15m' });
  });
  res.json({ accessToken });
});

A The refreshToken is not read from the request body, causing undefined token error.

B The accessToken variable is used outside the jwt.verify callback, causing a ReferenceError.

C The jwt.sign method is missing the payload argument, causing a TypeError.

D The route does not handle missing refreshToken, causing a crash.

💡 Hint

Check where accessToken is declared and used.

accessToken is declared inside the callback but used outside, so it is undefined when res.json runs, causing a ReferenceError.