Session-based auth with express-session - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the express-session middleware.

Express

const session = require('[1]');

Drag options to blanks, or click blank then click option'

Aexpress-session-middleware

Bexpress-session

Csession-express

Dexpress-session-auth

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect package names like 'express-session-auth' or 'session-express'.

Forgetting to install the package before importing.

The express-session package is imported using require('express-session').

2fill in blank

medium

Complete the code to initialize express-session middleware with a secret.

Express

app.use(session({ secret: '[1]', resave: false, saveUninitialized: true }));

Drag options to blanks, or click blank then click option'

AsecretKey

B12345

CsessionSecret

DmySecret

Attempts:

3 left

💡 Hint

Common Mistakes

Using numbers instead of strings for the secret.

Leaving the secret empty or undefined.

The secret option is a string used to sign the session ID cookie. Here, 'mySecret' is a valid example.

3fill in blank

hard

Fix the error in the code to save a username in the session after login.

Express

app.post('/login', (req, res) => {
  req.session.[1] = req.body.username;
  res.send('Logged in');
});

Drag options to blanks, or click blank then click option'

Aname

Buser

Cusername

DuserName

Attempts:

3 left

💡 Hint

Common Mistakes

Using inconsistent property names like 'user' or 'name' which may cause confusion.

Misspelling the property name.

The session property to store the username should be named clearly, here 'username' matches the data stored.

4fill in blank

hard

Fill both blanks to check if a user is logged in and redirect accordingly.

Express

app.get('/dashboard', (req, res) => {
  if (!req.session.[1]) {
    res.redirect('[2]');
  } else {
    res.send('Welcome to your dashboard');
  }
});

Drag options to blanks, or click blank then click option'

Ausername

B/login

C/home

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Checking wrong session property like 'user' instead of 'username'.

Redirecting to the wrong path like '/home' instead of '/login'.

Check if req.session.username exists to confirm login. If not, redirect to /login page.

5fill in blank

hard

Fill all three blanks to destroy the session on logout and redirect to home.

Express

app.post('/logout', (req, res) => {
  req.session.[1](err => {
    if (err) {
      return res.status(500).send('Error logging out');
    }
    res.[2]('[3]');
  });
});

Drag options to blanks, or click blank then click option'

Adestroy

Bredirect

C/

Dend

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'end' instead of 'destroy' to clear the session.

Using 'res.send' instead of 'res.redirect' after logout.

Redirecting to a wrong path instead of '/'.

Use req.session.destroy() to end the session. Then use res.redirect('/') to send the user to the home page.

Practice

1. What is the main purpose of using express-session in an Express app?

easy

A. To store user data on the server and keep users logged in across requests

B. To encrypt user passwords before saving to the database

C. To serve static files like images and CSS

D. To handle HTTP request routing

Solution

1. Step 1: Understand session purpose

   Sessions store user info on the server to remember users between requests.

2. Step 2: Identify express-session role

   The express-session middleware manages these sessions automatically.

3. Final Answer:

   To store user data on the server and keep users logged in across requests -> Option A

4. Quick Check:

   Session-based auth = store user data server-side [OK]

Hint: Sessions keep user info server-side to maintain login [OK]

Common Mistakes:

• Confusing sessions with password encryption
• Thinking sessions serve static files
• Mixing routing with session management

2. Which of the following is the correct way to initialize express-session middleware in an Express app?

easy

A. app.use(expressSession('keyboard cat'))

B. app.session({ secret: 'keyboard cat', resave: true })

C. app.use(session({ secret: 'keyboard cat', resave: false, saveUninitialized: true }))

D. app.sessionMiddleware({ secret: 'keyboard cat' })

Solution

1. Step 1: Recall express-session syntax

   The middleware is added with app.use(session({ options })).

2. Step 2: Check options correctness

   Options like secret, resave, and saveUninitialized are standard.

3. Final Answer:

   app.use(session({ secret: 'keyboard cat', resave: false, saveUninitialized: true })) -> Option C

4. Quick Check:

   Use app.use(session({...})) with options [OK]

Hint: Use app.use(session({ secret, resave, saveUninitialized })) [OK]

Common Mistakes:

• Using app.session instead of app.use
• Passing secret as a string directly
• Calling non-existent methods like sessionMiddleware

3. Given this Express route using express-session:

app.get('/dashboard', (req, res) => {
  if (req.session.user) {
    res.send(`Welcome, ${req.session.user}!`);
  } else {
    res.status(401).send('Please log in');
  }
});

// Assume req.session.user = 'Alice'

What will the server respond when a logged-in user visits /dashboard?

medium

A. Welcome, Alice!

B. Please log in

C. Error: req.session.user is undefined

D. Redirect to login page

Solution

1. Step 1: Check session user existence

   The code checks if req.session.user exists; here it is 'Alice'.

2. Step 2: Determine response

   Since user exists, it sends Welcome, Alice! as response.

3. Final Answer:

   Welcome, Alice! -> Option A

4. Quick Check:

   Session user present = welcome message [OK]

Hint: If req.session.user exists, show welcome message [OK]

Common Mistakes:

• Assuming undefined session user causes error
• Expecting redirect without code
• Confusing status 401 with success message

4. Consider this code snippet for session setup:

const session = require('express-session');
app.use(session({
  secret: 'secret123',
  resave: false
}));

What is the likely problem with this setup?

medium

A. Session middleware must be added after routes

B. Missing saveUninitialized option may cause sessions not to save properly

C. resave must be true to save sessions

D. The secret should be a number, not a string

Solution

1. Step 1: Review required session options

   While secret and resave are set, saveUninitialized is missing.

2. Step 2: Understand saveUninitialized role

   Without saveUninitialized, some sessions may not be saved, causing unexpected behavior.

3. Final Answer:

   Missing saveUninitialized option may cause sessions not to save properly -> Option B

4. Quick Check:

   Always set saveUninitialized option [OK]

Hint: Always include saveUninitialized in session config [OK]

Common Mistakes:

• Thinking secret must be a number
• Believing resave must be true
• Adding middleware after routes

5. You want to protect a route so only logged-in users can access it using express-session. Which middleware function correctly checks the session and redirects unauthorized users to /login?

hard

A. function auth(req, res, next) { if (req.session.user) res.redirect('/login'); else next(); }

B. function auth(req, res) { if (!req.session.user) next(); else res.redirect('/login'); }

C. function auth(req, res, next) { if (req.session.user === undefined) res.send('Access granted'); else next(); }

D. function auth(req, res, next) { if (req.session.user) next(); else res.redirect('/login'); }

Solution

1. Step 1: Understand middleware signature

   Middleware must have (req, res, next) and call next() to continue.

2. Step 2: Check session user and redirect logic

   If req.session.user exists, call next() to allow access; otherwise redirect to /login.

3. Final Answer:

   function auth(req, res, next) { if (req.session.user) next(); else res.redirect('/login'); } -> Option D

4. Quick Check:

   Session user? next() : redirect [OK]

Hint: Call next() if logged in; else redirect to login [OK]

Common Mistakes:

• Missing next() call in middleware
• Reversing condition logic
• Sending response instead of redirecting