Why security is critical in Node.js - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the built-in Node.js module for handling HTTPS requests.

Node.js

const https = require('[1]');

Drag options to blanks, or click blank then click option'

Afs

Bhttp

Curl

Dhttps

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' instead of 'https' which is not secure.

Confusing 'fs' (file system) with network modules.

The https module is used to create secure servers and handle HTTPS requests in Node.js.

2fill in blank

medium

Complete the code to create a secure HTTPS server using Node.js.

Node.js

const server = https.createServer({ key: privateKey, cert: certificate }, [1]);

Drag options to blanks, or click blank then click option'

AhandleRequest

BrequestListener

CcreateServer

Dlisten

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the wrong function name or method.

Confusing server creation with listening.

The second argument to https.createServer is a request listener function that handles incoming requests.

3fill in blank

hard

Fix the error in the code to properly handle user input securely.

Node.js

app.post('/login', (req, res) => {
  const username = req.body.[1];
  // process login
});

Drag options to blanks, or click blank then click option'

Aname

Buser

Cusername

Did

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect property names that do not exist in the request body.

Not validating or sanitizing user input.

The property username is commonly used to access the username field from the request body.

4fill in blank

hard

Fill both blanks to create a middleware that protects routes by checking authentication.

Node.js

function authMiddleware(req, res, [1]) {
  if (!req.user) {
    return res.status([2]).send('Unauthorized');
  }
  next();
}

Drag options to blanks, or click blank then click option'

Anext

B401

C403

Derror

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong parameter names in middleware.

Sending incorrect HTTP status codes.

The middleware function uses next to pass control and sends a 401 status code for unauthorized access.

5fill in blank

hard

Fill all three blanks to safely parse JSON input and handle errors in a Node.js server.

Node.js

app.use(express.text());

app.post('/data', (req, res) => {
  try {
    const data = JSON.[1](req.body);
    res.send([2]);
  } catch ([3]) {
    res.status(400).send('Invalid JSON');
  }
});

Drag options to blanks, or click blank then click option'

Aparse

Bdata

Cerror

Dstringify

Attempts:

3 left

💡 Hint

Common Mistakes

Using JSON.stringify instead of JSON.parse for input.

Not catching errors properly.

Use JSON.parse to convert JSON string to object, store it in data, and catch errors with error.

Practice

1. Why is security critical in a Node.js application?

easy

A. To make the app run faster

B. To protect user data and prevent unauthorized access

C. To reduce the size of the code

D. To add more features quickly

Solution

1. Step 1: Understand the purpose of security

   Security is meant to protect sensitive information and prevent unauthorized users from accessing the app.

2. Step 2: Identify the main goal in Node.js apps

   Protecting user data and access is the main goal, not performance or code size.

3. Final Answer:

   To protect user data and prevent unauthorized access -> Option B

4. Quick Check:

   Security = Protect data [OK]

Hint: Security is about protection, not speed or features [OK]

Common Mistakes:

• Confusing security with performance optimization
• Thinking security adds features
• Believing security reduces code size

2. Which of the following is the correct way to hash a password in Node.js using bcrypt?

easy

A. bcrypt.hash(password, saltRounds, callback)

B. bcrypt.encrypt(password, saltRounds)

C. bcrypt.encode(password)

D. bcrypt.secure(password)

Solution

1. Step 1: Recall bcrypt method names

   The correct method to hash passwords is bcrypt.hash with parameters password, saltRounds, and a callback.

2. Step 2: Check other options for validity

   Methods encrypt, encode, and secure do not exist in bcrypt library.

3. Final Answer:

   bcrypt.hash(password, saltRounds, callback) -> Option A

4. Quick Check:

   Use bcrypt.hash() to hash passwords [OK]

Hint: Remember bcrypt.hash for password hashing [OK]

Common Mistakes:

• Using non-existent bcrypt methods
• Confusing encrypt with hash
• Omitting callback in bcrypt.hash

3. What will be the output of this Node.js code snippet?

const helmet = require('helmet');
const express = require('express');
const app = express();
app.use(helmet());
app.get('/', (req, res) => res.send('Hello'));
console.log(app._router.stack.length);

medium

A. 2

B. 4

C. 3

D. 1

Solution

1. Step 1: Count middleware layers added

   helmet() adds one middleware layer, and app.get adds another route layer, totaling two layers.

2. Step 2: Confirm the stack length

   app._router.stack includes both middleware and routes, so length is 2.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   Middleware + route = 2 layers [OK]

Hint: Count middleware and routes in app._router.stack [OK]

Common Mistakes:

• Assuming helmet adds multiple layers
• Ignoring middleware in stack count
• Confusing routes with middleware layers

4. Identify the security issue in this Node.js code snippet:

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  if (username === 'admin' && password === 'admin123') {
    res.send('Welcome admin');
  } else {
    res.status(401).send('Unauthorized');
  }
});

medium

A. The response status code is incorrect

B. The route uses POST method instead of GET

C. Passwords are stored and checked in plain text

D. The username is hardcoded

Solution

1. Step 1: Analyze password handling

   The password is checked directly as plain text, which is insecure because passwords should be hashed.

2. Step 2: Review other options

   POST is correct for login, status 401 is appropriate, and hardcoded username is less critical than password handling.

3. Final Answer:

   Passwords are stored and checked in plain text -> Option C

4. Quick Check:

   Plain text passwords = security risk [OK]

Hint: Never check passwords as plain text [OK]

Common Mistakes:

• Thinking POST method is insecure
• Ignoring password hashing importance
• Confusing status codes

5. You want to secure a Node.js API by validating user input and preventing injection attacks. Which combination of practices is best?

hard

A. Only use HTTPS and ignore input validation

B. Disable CORS and avoid using middleware

C. Store passwords in plain text but use secure headers

D. Use input validation libraries, sanitize inputs, and keep dependencies updated

Solution

1. Step 1: Identify best security practices

   Validating and sanitizing inputs prevents injection attacks; updating dependencies fixes known vulnerabilities.

2. Step 2: Evaluate other options

   HTTPS alone is not enough; storing plain text passwords is unsafe; disabling CORS and avoiding middleware reduces security.

3. Final Answer:

   Use input validation libraries, sanitize inputs, and keep dependencies updated -> Option D

4. Quick Check:

   Validate + sanitize + update = secure API [OK]

Hint: Validate and sanitize inputs, update often [OK]

Common Mistakes:

• Relying only on HTTPS
• Storing passwords insecurely
• Disabling security middleware