Why authorization differs from authentication in Express - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Authentication in Express

What is the primary purpose of authentication in an Express application?

A To log user activity for auditing purposes

B To verify the identity of a user trying to access the system

C To encrypt user data before sending it to the client

D To determine what resources a user can access

💡 Hint

Think about the step where the system checks who you are.

Authentication is about confirming who the user is, usually by checking credentials like username and password.

🧠 Conceptual

intermediate

Understanding Authorization in Express

What does authorization control in an Express application?

A It controls which resources or actions a verified user is allowed to access or perform

B It verifies the user's identity using tokens

C It manages session expiration times

D It encrypts passwords before storing them

💡 Hint

Think about what happens after the system knows who you are.

Authorization decides what an authenticated user can do or see within the system.

❓ component_behavior

advanced

Behavior of Authentication Middleware in Express

Given the following Express middleware, what happens if the user is not authenticated?

Express

function authMiddleware(req, res, next) {
  if (!req.user) {
    return res.status(401).send('Unauthorized');
  }
  next();
}

A The middleware sends a 401 Unauthorized response and stops further processing

B The middleware allows the request to continue to the next handler

C The middleware throws a runtime error

D The middleware redirects the user to the home page

💡 Hint

Look at the condition checking req.user and the response sent.

If req.user is missing, the middleware responds with 401 and does not call next(), stopping the request.

❓ component_behavior

advanced

Authorization Check in Express Route

In this Express route, what will happen if the authenticated user does not have the 'admin' role?

Express

app.get('/admin', (req, res) => {
  if (!req.user?.roles.includes('admin')) {
    return res.status(403).send('Forbidden');
  }
  res.send('Welcome Admin');
});

A The server responds with 401 Unauthorized

B The server sends 'Welcome Admin' regardless of user role

C The server crashes with a TypeError

D The server responds with 403 Forbidden and does not send 'Welcome Admin'

💡 Hint

Check the condition that tests the user's roles.

If the user lacks the 'admin' role, the route sends a 403 Forbidden response and does not proceed.

📝 Syntax

expert

Identify the Error in Authentication Middleware

What error will this Express authentication middleware produce when a request is made?

Express

function auth(req, res, next) {
  if (req.headers.authorization === undefined) {
    return res.status(401).send('No token');
  }
  next();
}

A The middleware causes a syntax error due to missing braces

B The middleware throws a ReferenceError because next is undefined

C The middleware calls next() even after sending a response, causing headers to be sent twice

D The middleware correctly stops processing after sending 401

💡 Hint

Consider what happens after res.status(401).send() is called.

After sending a response, calling next() continues processing, which can cause errors because headers are already sent.