Refresh token concept in Express - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Express library.

Express

const express = require([1]);

Drag options to blanks, or click blank then click option'

A"express"

B"http"

C"fs"

D"path"

Attempts:

3 left

💡 Hint

Common Mistakes

Using other module names like 'http' or 'fs' instead of 'express'.

Forgetting the quotes around the module name.

The Express library is imported using require with the string "express".

2fill in blank

medium

Complete the code to create a new Express application instance.

Express

const app = [1]();

Drag options to blanks, or click blank then click option'

Ahttp

Brouter

Cserver

Dexpress

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' or 'server' which are not Express app creators.

Trying to call something that is not a function.

To create an Express app, call the express function.

3fill in blank

hard

Fix the error in the middleware that reads the refresh token from cookies.

Express

app.use((req, res, next) => {
  const refreshToken = req.cookies[1];
  if (!refreshToken) return res.sendStatus(401);
  next();
});

Drag options to blanks, or click blank then click option'

A[refreshToken]

B.refreshToken

C['refreshToken']

D(refreshToken)

Attempts:

3 left

💡 Hint

Common Mistakes

Using dot notation which may fail if cookie name has special characters.

Using parentheses which is invalid syntax.

To access a cookie named 'refreshToken', use bracket notation with the string key: req.cookies['refreshToken'].

4fill in blank

hard

Fill both blanks to verify the refresh token and generate a new access token.

Express

jwt.verify(refreshToken, [1], (err, user) => {
  if (err) return res.sendStatus(403);
  const accessToken = jwt.sign({ id: user.id }, [2], { expiresIn: '15m' });
  res.json({ accessToken });
});

Drag options to blanks, or click blank then click option'

A"REFRESH_TOKEN_SECRET"

B"ACCESS_TOKEN_SECRET"

C"INVALID_SECRET"

D"ANOTHER_SECRET"

Attempts:

3 left

💡 Hint

Common Mistakes

Using the same secret for both verification and signing.

Using invalid or wrong secret strings.

The refresh token is verified with the refresh token secret, and the new access token is signed with the access token secret.

5fill in blank

hard

Fill all three blanks to create a route that issues a refresh token and sets it as an HTTP-only cookie.

Express

app.post('/refresh', (req, res) => {
  const user = req.body;
  const refreshToken = jwt.sign(user, [1], { expiresIn: '7d' });
  res.cookie('refreshToken', refreshToken, { httpOnly: [2], secure: [3] });
  res.json({ refreshToken });
});

Drag options to blanks, or click blank then click option'

A"REFRESH_TOKEN_SECRET"

Btrue

Cfalse

D"ACCESS_TOKEN_SECRET"

Attempts:

3 left

💡 Hint

Common Mistakes

Using the access token secret to sign the refresh token.

Setting httpOnly or secure to false, which reduces security.

The refresh token is signed with the refresh token secret. The cookie is set with httpOnly and secure flags as true for security.