Testing authentication flows in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main goal of testing authentication flows in an Express app?

To ensure that users can securely log in, access protected routes only when authenticated, and that invalid credentials are handled properly.

beginner

Which HTTP status code usually indicates a successful login in an authentication flow?

Status code 200 means success, but often 302 is used for redirect after login. For APIs, 200 with a token is common.

intermediate

Why do we test protected routes with and without authentication tokens?

To verify that protected routes deny access without valid tokens and allow access when tokens are valid, ensuring security.

beginner

What tool can you use to simulate HTTP requests when testing Express authentication flows?

Supertest is a popular tool to simulate HTTP requests and test Express routes including authentication.

beginner

How can you test that an Express app correctly handles invalid login credentials?

By sending a login request with wrong username or password and checking the response status and error message.

What should happen when a user tries to access a protected route without a valid token?

A The server should respond with a 401 Unauthorized status.

B The server should allow access.

C The server should crash.

D The server should redirect to a public page.

Protected routes require valid tokens; without them, the server responds with 401 Unauthorized.

Which library is commonly used to test HTTP requests in Express apps?

A React Testing Library

B Supertest

C Jest DOM

D Mocha UI

Supertest is designed to test HTTP endpoints in Node.js and Express apps.

What is a common way to test login success in an API authentication flow?

A Check for a 404 status code.

B Check if the server logs an error.

C Check if the page reloads.

D Check for a token in the response body.

A successful login usually returns a token that the client uses for future requests.

Why is it important to test both valid and invalid login attempts?

A To verify the app handles all cases securely and correctly.

B To ensure the app crashes gracefully.

C To speed up the login process.

D To make the UI look better.

Testing both cases ensures security and proper user feedback.

What status code usually indicates that login credentials are incorrect?

A 200 OK

B 500 Internal Server Error

C 401 Unauthorized

D 302 Found

401 Unauthorized means the credentials were rejected.

Explain how you would write a test to verify that a protected route in Express denies access without a token.

Think about what happens when someone tries to enter a locked door without a key.

Describe the steps to test a login endpoint for both successful and failed login attempts.

Imagine testing a door lock with the right and wrong keys.