Why authentication matters in Express - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Express library.

Express

const express = require('[1]');

Drag options to blanks, or click blank then click option'

Afs

Bhttp

Cpath

Dexpress

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different library name like 'http' instead of 'express'.

Forgetting to put the library name inside quotes.

The Express library is imported using require('express'). This allows us to create an Express app.

2fill in blank

medium

Complete the code to create a new Express app instance.

Express

const app = [1]();

Drag options to blanks, or click blank then click option'

Ahttp

Bexpress

Crouter

Dserver

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' instead of 'express' to create the app.

Trying to create app without calling a function.

Calling express() creates a new Express application instance.

3fill in blank

hard

Fix the error in the middleware that checks if a user is authenticated.

Express

function checkAuth(req, res, next) {
  if (!req.user) {
    return res.status([1]).send('Unauthorized');
  }
  next();
}

Drag options to blanks, or click blank then click option'

A401

B404

C500

D200

Attempts:

3 left

💡 Hint

Common Mistakes

Using 200 which means success.

Using 500 which means server error.

Using 404 which means not found.

The HTTP status code 401 means 'Unauthorized', which is correct when a user is not authenticated.

4fill in blank

hard

Fill both blanks to create a route that requires authentication before sending a response.

Express

app.[1]('/dashboard', [2], (req, res) => {
  res.send('Welcome to your dashboard');
});

Drag options to blanks, or click blank then click option'

Aget

Bpost

CcheckAuth

Dexpress.json()

Attempts:

3 left

💡 Hint

Common Mistakes

Using POST instead of GET for a page route.

Using unrelated middleware like express.json() instead of checkAuth.

The route uses get to respond to GET requests and checkAuth middleware to ensure the user is authenticated.

5fill in blank

hard

Fill all three blanks to set up a login route that authenticates user credentials and sends a success message.

Express

app.[1]('/login', (req, res) => {
  const { username, password } = req.[2];
  if (username === 'admin' && password === 'secret') {
    res.[3]('Login successful');
  } else {
    res.status(401).send('Invalid credentials');
  }
});

Drag options to blanks, or click blank then click option'

Apost

Bbody

Csend

Dquery

Attempts:

3 left

💡 Hint

Common Mistakes

Using GET instead of POST for login.

Reading credentials from req.query instead of req.body.

Using res.status() without send() to respond.

The login route uses POST method, reads credentials from req.body, and sends a response with res.send().

Practice

1. Why is authentication important in an Express app?

easy

A. It speeds up the app's performance.

B. It confirms the user's identity to protect data and features.

C. It changes the app's color scheme.

D. It automatically fixes bugs in the code.

Solution

1. Step 1: Understand the purpose of authentication

   Authentication is used to confirm who a user is before allowing access.

2. Step 2: Connect authentication to app protection

   By confirming identity, the app protects sensitive data and features from unauthorized users.

3. Final Answer:

   It confirms the user's identity to protect data and features. -> Option B

4. Quick Check:

   Authentication = Confirm identity [OK]

Hint: Authentication means checking who the user is [OK]

Common Mistakes:

• Thinking authentication improves speed
• Confusing authentication with UI changes
• Believing it fixes code bugs automatically

2. Which Express code snippet correctly checks if a user is authenticated before accessing a route?

easy

A. app.get('/dashboard', (req, res) => { if(req.user) { res.redirect('/login'); } else { res.send('Welcome'); } });

B. app.get('/dashboard', (req, res) => { res.send('Welcome'); });

C. app.get('/dashboard', (req, res) => { if(req.isAuthenticated()) { res.send('Welcome'); } else { res.redirect('/login'); } });

D. app.get('/dashboard', (req, res) => { res.redirect('/logout'); });

Solution

1. Step 1: Identify authentication check method

   The method req.isAuthenticated() is commonly used to check if a user is logged in.

2. Step 2: Verify correct route behavior

   If authenticated, the user sees 'Welcome'; otherwise, they are redirected to login.

3. Final Answer:

   app.get('/dashboard', (req, res) => { if(req.isAuthenticated()) { res.send('Welcome'); } else { res.redirect('/login'); } }); -> Option C

4. Quick Check:

   Use req.isAuthenticated() to protect routes [OK]

Hint: Look for req.isAuthenticated() to check login [OK]

Common Mistakes:

• Not checking authentication before sending response
• Redirecting authenticated users to login
• Redirecting users to logout instead of login

3. What will be the output when an unauthenticated user tries to access this Express route?

app.get('/profile', (req, res) => {
  if (!req.isAuthenticated()) {
    res.status(401).send('Access denied');
  } else {
    res.send('User profile');
  }
});

medium

A. Access denied

B. Redirect to /login

C. 404 Not Found

D. User profile

Solution

1. Step 1: Check authentication condition

   The code sends 'Access denied' with status 401 if req.isAuthenticated() is false.

2. Step 2: Determine output for unauthenticated user

   Since the user is unauthenticated, the condition is true and 'Access denied' is sent.

3. Final Answer:

   Access denied -> Option A

4. Quick Check:

   Unauthenticated user gets 'Access denied' [OK]

Hint: Check if condition sends 'Access denied' for unauthenticated [OK]

Common Mistakes:

• Assuming unauthenticated users see profile
• Expecting a redirect instead of 401 status
• Confusing 404 with access denial

4. Identify the error in this Express authentication middleware:

function auth(req, res, next) {
  if (req.isAuthenticated) {
    next();
  } else {
    res.redirect('/login');
  }
}

medium

A. res.redirect should be res.sendRedirect

B. next() should be res.next()

C. Middleware should return a value

D. Missing parentheses in req.isAuthenticated call

Solution

1. Step 1: Check how req.isAuthenticated is used

   The code uses req.isAuthenticated without parentheses, treating it as a property.

2. Step 2: Correct usage of req.isAuthenticated()

   It is a function and must be called with parentheses: req.isAuthenticated().

3. Final Answer:

   Missing parentheses in req.isAuthenticated call -> Option D

4. Quick Check:

   Call req.isAuthenticated() as a function [OK]

Hint: Remember req.isAuthenticated() needs () to call [OK]

Common Mistakes:

• Using req.isAuthenticated without ()
• Confusing next() with res.next()
• Using wrong redirect method name

5. You want to protect multiple routes in your Express app so only authenticated users can access them. Which approach best applies authentication efficiently?

hard

A. Create an authentication middleware and apply it to all protected routes.

B. Add the authentication check inside each route handler separately.

C. Check authentication only on the homepage route.

D. Use client-side JavaScript to hide protected routes.

Solution

1. Step 1: Understand route protection needs

   Multiple routes require the same authentication check to avoid repeating code.

2. Step 2: Use middleware for efficient authentication

   Middleware can be applied to many routes at once, centralizing the check and improving maintainability.

3. Final Answer:

   Create an authentication middleware and apply it to all protected routes. -> Option A

4. Quick Check:

   Middleware centralizes authentication checks [OK]

Hint: Use middleware to protect many routes at once [OK]

Common Mistakes:

• Repeating authentication code in every route
• Checking only homepage leaves others unprotected
• Relying on client-side hiding for security