Express JS Express Security and Authentication

Question 1

What is the primary purpose of JSON Web Tokens (JWT) in an Express application?

Accepted Answer

Stateless authentication by encoding user identity in a signed token

Answer

Encrypting database connections

Answer

Storing session data server-side

Answer

Compressing JSON payloads

Question 2

How do you verify a JWT in an Express middleware using the jsonwebtoken package?

Accepted Answer

jwt.verify(token, secret, callback)

Answer

jwt.decode(token, secret)

Answer

jwt.check(token, secret)

Answer

jwt.authenticate(token, secret)

Question 3

What HTTP header is conventionally used to send a JWT in an API request?

Accepted Answer

Authorization: Bearer <token>

Answer

X-Auth-Token: <token>

Answer

Token: <token>

Answer

Auth: JWT <token>

Question 4

What does the helmet package help protect against in Express?

Accepted Answer

XSS, clickjacking, and other attacks by setting security HTTP headers

Answer

SQL injection

Answer

CSRF only

Answer

Brute-force login attempts

Question 5

Which middleware is commonly used to prevent Cross-Site Request Forgery (CSRF) in Express apps with sessions?

Accepted Answer

csurf (or modern alternatives like csrf-csrf)

Answer

helmet

Answer

cors

Answer

express-validator

Question 6

What is the purpose of bcrypt when handling passwords in an Express application?

Accepted Answer

Hashing passwords with a salt to securely store them

Answer

Encrypting passwords for transmission

Answer

Generating JWT secrets

Answer

Validating password format