Express JS Express Security and Authentication 2

Question 1

How does the express-session middleware store session data by default?

Accepted Answer

In-memory on the server (not suitable for production)

Answer

The default MemoryStore is in-process memory storage, which doesn't scale and leaks memory — use a persistent store in production.

Question 2

What is the purpose of setting httpOnly: true on session cookies in Express?

Accepted Answer

Prevents client-side JavaScript from accessing the cookie

Answer

The httpOnly flag prevents XSS attacks from stealing the session cookie via document.cookie in the browser.

Question 3

What does enabling 'trust proxy' in Express do for security?

Accepted Answer

Tells Express to trust the X-Forwarded-For and other proxy headers for correct IP/protocol detection

Answer

app.set('trust proxy', true) lets Express read X-Forwarded-For headers from a trusted reverse proxy for accurate req.ip.

Question 4

Which package is commonly used to implement Passport.js-based authentication in Express?

Accepted Answer

passport

Answer

passport is the widely-used authentication middleware for Express that supports hundreds of strategies including local, OAuth, and JWT.

Question 5

What is the role of CORS in an Express API security context?

Accepted Answer

Controls which origins are allowed to make cross-origin requests to the API

Answer

CORS headers restrict which web origins can call your API, preventing unauthorized cross-origin JavaScript from making API requests.

Express JS Practice Test