Testing authentication flows in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the response status code when a user provides valid credentials?

Consider an Express app with a POST /login route that checks username and password. If credentials are correct, it responds with status 200 and a JSON message {"message": "Login successful"}. What status code will the server respond with when valid credentials are sent?

Express

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  if(username === 'user' && password === 'pass') {
    res.status(200).json({ message: 'Login successful' });
  } else {
    res.status(401).json({ message: 'Unauthorized' });
  }
});

A 200

B 401

C 500

D 404

💡 Hint

Think about the HTTP status code for a successful login.

A status code of 200 means the request was successful. Since the credentials are valid, the server responds with 200.

❓ state_output

intermediate

What is the value of req.user after successful authentication?

In an Express middleware that authenticates a user and attaches user info to req.user, what will req.user contain after successful login?

Express

function authMiddleware(req, res, next) {
  const token = req.headers['authorization'];
  if(token === 'valid-token') {
    req.user = { id: 1, name: 'Alice' };
    next();
  } else {
    res.status(401).send('Unauthorized');
  }
}

A undefined

B { id: 1, name: 'Alice' }

C null

D An error is thrown

💡 Hint

Look at what the middleware assigns to req.user when the token is valid.

The middleware sets req.user to an object with id and name when the token is valid.

📝 Syntax

advanced

Which option causes a syntax error in Express route definition?

Identify the option that will cause a syntax error when defining an Express route.

Express

app.get('/profile', (req, res) => {
  res.send('User profile');
});

A app.get('/profile' (req, res) => { res.send('User profile'); });

B app.get('/profile', (req, res) => { res.send('User profile'); });

C app.get('/profile', function(req, res) { res.send('User profile'); });

D app.get('/profile', (req, res) => res.send('User profile'));

💡 Hint

Check for missing commas or parentheses.

Option A is missing a comma between the path and the callback function, causing a syntax error.

🔧 Debug

advanced

Why does this authentication middleware always call next() even with invalid tokens?

Given the middleware below, why does it always call next() even when the token is not 'valid-token'?

Express

function authMiddleware(req, res, next) {
  const token = req.headers['authorization'];
  if(token = 'valid-token') {
    next();
  } else {
    res.status(401).send('Unauthorized');
  }
}

A Because the token header is missing

B Because next() is not called properly

C Because the assignment operator '=' is used instead of comparison '==' or '===' in the if condition

D Because res.status is not chained correctly

💡 Hint

Look carefully at the if condition syntax.

The if condition uses '=' which assigns 'valid-token' to token instead of comparing it. This always evaluates to true, causing it to always call next(), even for invalid tokens.

🧠 Conceptual

expert

What is the main purpose of using sessions in authentication flows?

Why do Express apps often use sessions when handling authentication?

A To store user data on the client side permanently

B To speed up server response by caching all requests

C To encrypt user passwords before saving them

D To keep user login state across multiple requests without re-authenticating each time

💡 Hint

Think about how servers remember who you are after you log in.

Sessions allow the server to remember a user's login state across multiple requests, so the user doesn't have to log in every time.

Practice

1. What is the main purpose of testing authentication flows in an Express app?

easy

A. To check if the server can handle large amounts of traffic

B. To verify users can log in and access protected routes correctly

C. To ensure the database schema is optimized

D. To test the styling of the login page

Solution

1. Step 1: Understand authentication flow testing

   Testing authentication flows means checking if users can log in and access parts of the app that require login.

2. Step 2: Identify the main goal

   The main goal is to verify correct login and access control, not performance or styling.

3. Final Answer:

   To verify users can log in and access protected routes correctly -> Option B

4. Quick Check:

   Authentication testing = verify login and access [OK]

Hint: Authentication tests check login and access only [OK]

Common Mistakes:

• Confusing authentication testing with performance testing
• Thinking styling or database optimization is tested here
• Assuming authentication tests check UI design

2. Which of the following is the correct way to import and use supertest for testing an Express app's authentication route?

easy

A. const request = require('supertest'); const app = require('./app');

B. const supertest = import('supertest'); const app = require('./app');

C. import request from 'supertest'; import app from './app';

D. import * as request from 'supertest'; const app = require('./app');

Solution

1. Step 1: Identify CommonJS import syntax

   Most Express apps use CommonJS syntax with require, so const request = require('supertest'); is correct.

2. Step 2: Match import style for app

   Similarly, const app = require('./app'); is correct for CommonJS modules.

3. Final Answer:

   const request = require('supertest'); const app = require('./app'); -> Option A

4. Quick Check:

   Use CommonJS require for supertest and app [OK]

Hint: Use CommonJS require syntax for supertest and app [OK]

Common Mistakes:

• Mixing require() with import in CommonJS code
• Using dynamic import incorrectly
• Using namespace import when default import is expected

3. Given this test code snippet, what will be the status code returned when testing a protected route without authentication?

await request(app).get('/dashboard').expect(401);

medium

A. 401 (Unauthorized) - Access denied

B. 200 (OK) - Access granted

C. 404 (Not Found) - Route missing

D. 500 (Server Error) - Internal error

Solution

1. Step 1: Understand protected route behavior

   Protected routes require authentication; without it, the server should deny access.

2. Step 2: Identify correct HTTP status for unauthorized access

   HTTP status 401 means unauthorized access, which fits this case.

3. Final Answer:

   401 (Unauthorized) - Access denied -> Option A

4. Quick Check:

   Unauthenticated access to protected route = 401 [OK]

Hint: 401 means unauthorized access denied [OK]

Common Mistakes:

• Expecting 200 without authentication
• Confusing 401 with 404 or 500
• Assuming route is missing instead of protected

4. You wrote this test to check login failure:

await request(app).post('/login').send({ username: 'user', password: 'wrong' }).expect(401);

But the test fails even when the server returns 200. What is the likely mistake?

medium

A. The test should use GET instead of POST

B. The test is missing async/await keywords

C. The server does not properly check password and returns 200 anyway

D. The test should expect 404 instead of 401

Solution

1. Step 1: Analyze test expectation vs server behavior

   The test expects 401 for wrong password, but server returns 200, so server likely accepts wrong password.

2. Step 2: Identify root cause

   The server probably lacks proper password validation, causing incorrect success response.

3. Final Answer:

   The server does not properly check password and returns 200 anyway -> Option C

4. Quick Check:

   Wrong password but 200 means server validation missing [OK]

Hint: Check server password validation if test expects 401 but gets 200 [OK]

Common Mistakes:

• Assuming test syntax error without checking server logic
• Using wrong HTTP method for login
• Expecting wrong status code for authentication failure

5. You want to test that after a successful login, the user can access a protected route using the received token. Which sequence correctly tests this flow using supertest?

hard

A. Post login with wrong password, then get protected route with token

B. Get protected route first, then post login with token in body

C. Post login without saving token, then get protected route without headers

D. Post login, save token from response, then get protected route with Authorization header set to token

Solution

1. Step 1: Understand authentication token flow

   After login, server returns a token. This token must be sent in Authorization header to access protected routes.

2. Step 2: Identify correct test sequence

   First post login, save token from response, then use token in Authorization header for protected route request.

3. Final Answer:

   Post login, save token from response, then get protected route with Authorization header set to token -> Option D

4. Quick Check:

   Login -> save token -> use token in header for protected route [OK]

Hint: Save token after login, then use it in Authorization header [OK]

Common Mistakes:

• Trying to access protected route before login
• Not sending token in Authorization header
• Using wrong password in login step