Express JS Express Security and Authentication

Question 1

What is the primary purpose of JSON Web Tokens (JWT) in an Express application?

Accepted Answer

Stateless authentication by encoding user identity in a signed token

Answer

JWTs carry signed claims about a user, enabling stateless authentication without server-side session storage.

Question 2

How do you verify a JWT in an Express middleware using the jsonwebtoken package?

Accepted Answer

jwt.verify(token, secret, callback)

Answer

jwt.verify() validates the token's signature and expiration, returning the decoded payload if valid.

Question 3

What HTTP header is conventionally used to send a JWT in an API request?

Accepted Answer

Authorization: Bearer <token>

Answer

The Bearer token scheme in the Authorization header is the standard way to transmit JWTs with API requests.

Question 4

What does the helmet package help protect against in Express?

Accepted Answer

XSS, clickjacking, and other attacks by setting security HTTP headers

Answer

helmet sets headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security to mitigate common web attacks.

Question 5

Which middleware is commonly used to prevent Cross-Site Request Forgery (CSRF) in Express apps with sessions?

Accepted Answer

csurf (or modern alternatives like csrf-csrf)

Answer

CSRF middleware generates and validates per-session tokens to ensure requests originate from your own forms.

Express JS Practice Test