User login flow in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Express login route?

Consider this Express route handling a POST login request. What will the server respond with if the user provides correct credentials?

Express

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  if (username === 'admin' && password === '1234') {
    res.status(200).send('Login successful');
  } else {
    res.status(401).send('Unauthorized');
  }
});

A Responds with status 500 and message 'Server error' if username is 'admin'

B Responds with status 401 and message 'Unauthorized' for all inputs

C Responds with status 200 and message 'Welcome user' for any username

D Responds with status 200 and message 'Login successful' if username is 'admin' and password is '1234'

💡 Hint

Check the condition inside the if statement comparing username and password.

The route checks if username is 'admin' and password is '1234'. If true, it sends status 200 with 'Login successful'. Otherwise, it sends status 401 with 'Unauthorized'.

❓ state_output

intermediate

What is the value of 'isLoggedIn' after this middleware runs?

Given this Express middleware that sets a flag on the request object, what will be the value of 'req.isLoggedIn' after it runs if the user is authenticated?

Express

function authMiddleware(req, res, next) {
  if (req.headers.authorization === 'Bearer validtoken') {
    req.isLoggedIn = true;
  } else {
    req.isLoggedIn = false;
  }
  next();
}

A Always true regardless of headers

B true if 'authorization' header equals 'Bearer validtoken', otherwise false

C Always false regardless of headers

D Undefined because 'isLoggedIn' is not set

💡 Hint

Look at how 'req.isLoggedIn' is assigned based on the authorization header.

The middleware checks if the authorization header matches 'Bearer validtoken'. If yes, it sets 'req.isLoggedIn' to true; otherwise false.

🔧 Debug

advanced

Why does this login route always return 200 'Login successful'?

Examine the following Express login route. Why does it always respond with 200 'Login successful' even when incorrect credentials are sent?

Express

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  if (username === 'admin' && password === '1234') {
    res.status(200).send('Login successful');
  } else {
    res.status(401).send('Unauthorized');
  }
});

A Because '=' is used instead of '===' causing assignment instead of comparison

B Because 'req.body' is undefined by default in Express

C Because the route method should be GET, not POST

D Because the response is sent twice causing an error

💡 Hint

Check the operators used in the if condition.

The code uses '=' which assigns values instead of comparing. This causes the condition to always be truthy but the logic is broken, leading to unexpected behavior.

📝 Syntax

advanced

Which option correctly parses JSON body in Express login route?

You want to access 'req.body' in your Express login route. Which code snippet correctly enables JSON body parsing?

A

app.use(express.json());
app.post('/login', (req, res) => { /* access req.body */ });

B

app.use(bodyParser.urlencoded());
app.post('/login', (req, res) => { /* access req.body */ });

C app.post('/login', express.json(), (req, res) => { /* access req.body */ });

D

app.use(express.urlencoded());
app.post('/login', (req, res) => { /* access req.body */ });

💡 Hint

Look for middleware that parses JSON bodies globally.

Using 'app.use(express.json())' enables JSON body parsing for all routes. Other options either parse URL-encoded data or use middleware incorrectly.

🧠 Conceptual

expert

What is the main security risk if you do not hash passwords in a login flow?

In a user login flow, passwords are stored in plain text in the database. What is the biggest risk of this practice?

A The server will crash due to large password sizes

B Users will be unable to log in because passwords are not encrypted

C If the database is compromised, attackers get all user passwords in readable form

D Passwords will expire automatically after a short time

💡 Hint

Think about what happens if someone steals the database data.

Storing passwords in plain text means anyone who accesses the database can see all passwords. This is a major security risk.