[Solved] You have this API security code snippet: app.get('/user', (req, res) => { if (!req.headers['api_key']) { res.status(401).send('Unauthorized'); return;... What is the main problem with this code? | Rest API

Rest API - Authentication and Authorization

You have this API security code snippet:

app.get('/user', (req, res) => {
  if (!req.headers['api_key']) {
    res.status(401).send('Unauthorized');
    return;
  }
  res.send('User data');
});

What is the main problem with this code?

AIt does not handle errors properly.

BIt uses the wrong HTTP method for security.

CIt sends user data before checking the key.

DIt does not check if the API key is valid.

Step-by-Step Solution

Solution:

Step 1: Analyze the API key check
The code only checks if the 'api_key' header exists but does not verify if it is correct or valid.
Step 2: Understand the security implication
Without validating the key, anyone sending any 'api_key' header can access the data, which is insecure.
Final Answer:
It does not check if the API key is valid. -> Option D
Quick Check:
API key must be validated, not just present [OK]

Quick Trick: Check key validity, not just presence [OK]

Common Mistakes:

Assuming presence means valid
Confusing HTTP method with security
Ignoring error handling importance

Master "Authentication and Authorization" in Rest API

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Time

More Rest API Quizzes

You have this API security code snippet:

Step 1: Analyze the API key check

Step 2: Understand the security implication

Final Answer:

Quick Check:

Want More Practice?