Authentication in WebSocket connections in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

How does token authentication affect WebSocket connection establishment?

Consider a WebSocket server using Express and a token-based authentication system. What happens if the client tries to connect without sending a valid token in the connection request?

A The server accepts the connection and allows all messages without checking the token.

B The server upgrades the connection but disconnects the client after the first message.

C The server immediately closes the connection without upgrading the HTTP request to WebSocket.

D The server delays the connection upgrade until the token is verified asynchronously.

💡 Hint

Think about when authentication should happen in the WebSocket handshake process.

Token authentication must happen before upgrading the HTTP connection to WebSocket. If the token is missing or invalid, the server should reject the upgrade request immediately to prevent unauthorized access.

📝 Syntax

intermediate

Which code snippet correctly extracts a token from WebSocket connection headers in Express?

Given an Express WebSocket server, which code correctly retrieves a Bearer token from the Authorization header during the upgrade event?

A const token = req.headers.authorization.replace('Bearer ', '');

B const token = req.headers.authorization.split('Bearer')[1];

C const token = req.headers['Authorization'].split(' ')[0];

D const token = req.headers['authorization'].split(' ')[1];

💡 Hint

Remember the format of the Authorization header: 'Bearer <token>'.

The Authorization header usually looks like 'Bearer tokenvalue'. Splitting by space and taking the second part extracts the token correctly. Header keys are case-insensitive but usually lowercase in Node.js.

🔧 Debug

advanced

Why does this WebSocket server accept connections without token validation?

Review the following Express WebSocket upgrade handler code snippet:

server.on('upgrade', (req, socket, head) => {
  const token = req.headers['authorization']?.split(' ')[1];
  if (!token) {
    socket.destroy();
    return;
  }
  wss.handleUpgrade(req, socket, head, (ws) => {
    wss.emit('connection', ws, req);
  });
});

Clients without tokens still connect successfully. Why?

Express

server.on('upgrade', (req, socket, head) => {
  const token = req.headers['authorization']?.split(' ')[1];
  if (!token) {
    socket.destroy();
    return;
  }
  wss.handleUpgrade(req, socket, head, (ws) => {
    wss.emit('connection', ws, req);
  });
});

A The optional chaining operator returns undefined, so the if condition never triggers for missing headers.

B The server does not verify the token value; it only checks if it exists, so any token passes.

C The token variable is undefined but the socket.destroy() call is asynchronous and delayed.

D The handleUpgrade method upgrades the connection before the token check, allowing all clients.

💡 Hint

Look carefully at what the code does with the token after extracting it.

The code only checks if a token exists but does not verify if the token is valid. So any token string, even invalid, allows connection. Proper validation logic is missing.

❓ state_output

advanced

What is the value of ws.isAuthenticated after connection if token is valid?

In an Express WebSocket server, the following code runs on connection:

wss.on('connection', (ws, req) => {
  const token = req.headers['authorization']?.split(' ')[1];
  ws.isAuthenticated = verifyToken(token);
});

If verifyToken returns true for a valid token, what is the value of ws.isAuthenticated for a client with a valid token?

Express

wss.on('connection', (ws, req) => {
  const token = req.headers['authorization']?.split(' ')[1];
  ws.isAuthenticated = verifyToken(token);
});

A true

B null

C undefined

D false

💡 Hint

What does the verifyToken function return for valid tokens?

The code sets ws.isAuthenticated to the result of verifyToken(token). If the token is valid, verifyToken returns true, so ws.isAuthenticated is true.

🧠 Conceptual

expert

Why is authenticating during the WebSocket upgrade request preferred over authenticating after connection?

In Express WebSocket servers, why should authentication be done during the HTTP upgrade request instead of after the WebSocket connection is established?

A Because the HTTP upgrade request allows rejecting unauthorized clients before allocating WebSocket resources.

B Because WebSocket connections do not support sending headers after connection is established.

C Because authenticating after connection requires sending a special authentication message which is less secure.

D Because Express automatically blocks unauthorized WebSocket connections if authentication is done after connection.

💡 Hint

Think about resource usage and security risks of accepting connections before authentication.

Authenticating during the HTTP upgrade request lets the server reject unauthorized clients early, saving resources and preventing unauthorized access. Waiting until after connection wastes resources and may expose the server to attacks.