Testing authentication flows in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the response status code when a user provides valid credentials?

Consider an Express app with a POST /login route that checks username and password. If credentials are correct, it responds with status 200 and a JSON message {"message": "Login successful"}. What status code will the server respond with when valid credentials are sent?

Express

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  if(username === 'user' && password === 'pass') {
    res.status(200).json({ message: 'Login successful' });
  } else {
    res.status(401).json({ message: 'Unauthorized' });
  }
});

A 200

B 401

C 500

D 404

💡 Hint

Think about the HTTP status code for a successful login.

A status code of 200 means the request was successful. Since the credentials are valid, the server responds with 200.

❓ state_output

intermediate

What is the value of req.user after successful authentication?

In an Express middleware that authenticates a user and attaches user info to req.user, what will req.user contain after successful login?

Express

function authMiddleware(req, res, next) {
  const token = req.headers['authorization'];
  if(token === 'valid-token') {
    req.user = { id: 1, name: 'Alice' };
    next();
  } else {
    res.status(401).send('Unauthorized');
  }
}

A undefined

B { id: 1, name: 'Alice' }

C null

D An error is thrown

💡 Hint

Look at what the middleware assigns to req.user when the token is valid.

The middleware sets req.user to an object with id and name when the token is valid.

📝 Syntax

advanced

Which option causes a syntax error in Express route definition?

Identify the option that will cause a syntax error when defining an Express route.

Express

app.get('/profile', (req, res) => {
  res.send('User profile');
});

A app.get('/profile' (req, res) => { res.send('User profile'); });

B app.get('/profile', (req, res) => { res.send('User profile'); });

C app.get('/profile', function(req, res) { res.send('User profile'); });

D app.get('/profile', (req, res) => res.send('User profile'));

💡 Hint

Check for missing commas or parentheses.

Option A is missing a comma between the path and the callback function, causing a syntax error.

🔧 Debug

advanced

Why does this authentication middleware always call next() even with invalid tokens?

Given the middleware below, why does it always call next() even when the token is not 'valid-token'?

Express

function authMiddleware(req, res, next) {
  const token = req.headers['authorization'];
  if(token = 'valid-token') {
    next();
  } else {
    res.status(401).send('Unauthorized');
  }
}

A Because the token header is missing

B Because next() is not called properly

C Because the assignment operator '=' is used instead of comparison '==' or '===' in the if condition

D Because res.status is not chained correctly

💡 Hint

Look carefully at the if condition syntax.

The if condition uses '=' which assigns 'valid-token' to token instead of comparing it. This always evaluates to true, causing it to always call next(), even for invalid tokens.

🧠 Conceptual

expert

What is the main purpose of using sessions in authentication flows?

Why do Express apps often use sessions when handling authentication?

A To store user data on the client side permanently

B To speed up server response by caching all requests

C To encrypt user passwords before saving them

D To keep user login state across multiple requests without re-authenticating each time

💡 Hint

Think about how servers remember who you are after you log in.

Sessions allow the server to remember a user's login state across multiple requests, so the user doesn't have to log in every time.