Session-based auth with express-session - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after a successful login with express-session?

Consider this Express route using express-session for login:

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  if (username === 'user' && password === 'pass') {
    req.session.user = username;
    res.send('Logged in');
  } else {
    res.status(401).send('Unauthorized');
  }
});

What will be stored in the session after a successful login?

A Nothing is saved in the session; session remains empty.

B An object { username: 'user', password: 'pass' } is saved in req.session.user.

C The username string 'user' is saved in req.session.user.

D The password string 'pass' is saved in req.session.password.

💡 Hint

Look at what property of req.session is assigned after login.

The code assigns req.session.user = username, so the session stores the username string 'user'. Password is not saved.

❓ state_output

intermediate

What is the session state after logout?

Given this logout route:

app.post('/logout', (req, res) => {
  req.session.destroy(err => {
    if (err) {
      return res.status(500).send('Error');
    }
    res.send('Logged out');
  });
});

What is the state of req.session after logout completes successfully?

A req.session is undefined or null after destroy.

B req.session still contains previous user data.

C req.session is an empty object {}.

D req.session contains a flag loggedOut: true.

💡 Hint

What does req.session.destroy() do to the session?

Calling req.session.destroy() removes the session from store and clears req.session, making it undefined or null.

📝 Syntax

advanced

Which code correctly configures express-session middleware?

Choose the correct way to set up express-session middleware with a secret and resave option:

A app.use(session({ secret: 'mysecret', resave: false, saveUninitialized: true }));

B app.use(session({ secret: 'mysecret', resave: false, saveUninitialized }));

C app.use(session({ secret: 'mysecret', resave: 'false', saveUninitialized: true }));

D app.use(session = { secret: 'mysecret', resave: false, saveUninitialized: true });

💡 Hint

Check the syntax for calling middleware and option types.

Option A correctly calls session() with an options object. A uses assignment instead of function call. C uses string 'false' instead of boolean false. D uses undefined variable saveUninitialized.

🔧 Debug

advanced

Why does session data not persist between requests?

A developer uses express-session but notices session data resets on every request. Which mistake causes this?

app.use(session({
  secret: 'secret',
  resave: false,
  saveUninitialized: false
}));

app.get('/set', (req, res) => {
  req.session.value = 42;
  res.send('Value set');
});

app.get('/get', (req, res) => {
  res.send('Value: ' + req.session.value);
});

A saveUninitialized is false, so session never created.

B resave is false, so session never saves changes.

C The app is missing cookie-parser middleware before session.

D The client does not accept cookies, so session ID is lost.

💡 Hint

Think about how sessions track users across requests.

If the client blocks cookies, the session ID cookie is not sent back, so server treats each request as new session.

🧠 Conceptual

expert

What is the main security risk if express-session secret is exposed?

If the secret used in express-session middleware is leaked, what is the biggest risk?

A Attackers can read all session data stored on the server.

B Attackers can forge session cookies and impersonate users.

C Attackers can delete sessions from the session store remotely.

D Attackers can cause the server to crash by sending malformed cookies.

💡 Hint

Think about what the secret is used for in cookie signing.

The secret signs the session ID cookie. If exposed, attackers can create fake cookies to impersonate users.