Session-based vs token-based auth in Node.js - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is a key difference between session-based and token-based authentication?

Choose the option that best describes a fundamental difference between session-based and token-based authentication methods.

A Session-based auth stores user data on the server, while token-based auth stores user data on the client.

B Session-based auth requires the client to send a token with every request, token-based does not.

C Token-based auth stores session data on the server, session-based stores it in cookies.

D Token-based auth only works with cookies, session-based only with local storage.

💡 Hint

Think about where the user state is kept in each method.

Session-based authentication keeps user session data on the server, linked by a session ID stored in a cookie. Token-based authentication stores all user info inside the token itself, which the client holds and sends with requests.

❓ component_behavior

intermediate

What happens when a token expires in token-based authentication?

In token-based authentication, what is the typical behavior when the token expires?

A The server automatically renews the token without client action.

B The session on the server is cleared but the token remains valid.

C The client must re-authenticate to get a new token.

D The token silently refreshes in the background without user notice.

💡 Hint

Consider who controls token renewal in token-based auth.

When a token expires, the client must usually log in again or use a refresh token to get a new token. The server does not renew tokens automatically without client request.

🔧 Debug

advanced

Why does this session-based auth code fail to keep user logged in?

Examine the Node.js Express code below. Why does the user get logged out immediately after login?

Node.js

app.post('/login', (req, res) => {
  const user = authenticate(req.body.username, req.body.password);
  if (user) {
    req.session.user = user;
    res.redirect('/dashboard');
  } else {
    res.status(401).send('Login failed');
  }
});

app.get('/dashboard', (req, res) => {
  if (!req.session.user) {
    res.redirect('/login');
  } else {
    res.send(`Welcome ${req.session.user.name}`);
  }
});

A The session cookie is set to expire immediately.

B The authenticate function returns null causing session.user to be undefined.

C The redirect after login clears the session data.

D The session middleware is not configured or used in the app.

💡 Hint

Check if the app uses session middleware properly.

If the app does not use session middleware like express-session, req.session will be undefined or not persist data, causing the user to appear logged out.

📝 Syntax

advanced

Which code snippet correctly verifies a JWT token in Node.js?

Choose the code snippet that correctly verifies a JWT token using the jsonwebtoken library.

A jwt.verify(token, secret, (err, decoded) => { if (err) throw err; console.log(decoded); });

B jwt.verify(token, (err, decoded) => { if (err) throw err; console.log(decoded); });

C jwt.decode(token, secret, (err, decoded) => { if (err) throw err; console.log(decoded); });

D jwt.check(token, secret, (err, decoded) => { if (err) throw err; console.log(decoded); });

💡 Hint

Look for the correct method name and parameters for verifying a JWT.

The jsonwebtoken library uses jwt.verify(token, secret, callback) to verify tokens. jwt.decode does not verify signature, and jwt.check does not exist.

❓ state_output

expert

What is the output of this token-based auth middleware when token is missing?

Given the following Express middleware, what response does the server send if the request has no Authorization header?

Node.js

function authMiddleware(req, res, next) {
  const authHeader = req.headers['authorization'];
  if (!authHeader) {
    return res.status(401).json({ error: 'No token provided' });
  }
  const token = authHeader.split(' ')[1];
  jwt.verify(token, 'secret', (err, user) => {
    if (err) return res.status(403).json({ error: 'Invalid token' });
    req.user = user;
    next();
  });
}

A Server crashes with TypeError

B {"error":"No token provided"} with status 401

C Next middleware is called without error

D {"error":"Invalid token"} with status 403

💡 Hint

Check the condition when Authorization header is missing.

If the Authorization header is missing, the middleware returns a 401 status with JSON error 'No token provided' and does not call next().