MEAN MEAN Stack Security and Deployment 1 — Questions and Answers
Question 1: What is JWT (JSON Web Token) and how is it used for authentication in a MEAN stack?
- A self-contained token encoding user claims that Angular sends in Authorization headers for Express to verify (Correct answer)
- A session cookie stored in MongoDB for tracking user logins
- A database encryption standard for storing passwords in MongoDB
- A two-factor authentication protocol for Node.js APIs
Correct answer: A self-contained token encoding user claims that Angular sends in Authorization headers for Express to verify
JWT is a signed, base64-encoded token containing user claims; Angular stores it (localStorage/memory) and sends it in Authorization: Bearer headers, which Express validates with the secret key.
Question 2: What is bcrypt used for in a Node.js Express application?
- Hashing passwords with a salt before storing in MongoDB to protect against rainbow table attacks (Correct answer)
- Encrypting JWT tokens for secure transmission
- Compressing MongoDB documents for storage efficiency
- Generating secure random tokens for password reset
Correct answer: Hashing passwords with a salt before storing in MongoDB to protect against rainbow table attacks
bcrypt hashes passwords with a random salt and configurable cost factor, making brute-force and rainbow table attacks computationally expensive even if the database is compromised.
Question 3: What is Cross-Site Scripting (XSS) and how does Angular protect against it?
- Injecting malicious scripts into web pages; Angular auto-sanitizes all data bound to templates by treating it as text (Correct answer)
- Forging HTTP requests with stolen credentials; Angular uses CSRF tokens
- Intercepting network requests between Angular and Express
- Accessing MongoDB directly from the browser
Correct answer: Injecting malicious scripts into web pages; Angular auto-sanitizes all data bound to templates by treating it as text
XSS injects malicious scripts into pages viewed by other users; Angular's template engine treats all values as untrusted text by default, escaping HTML before rendering.
Question 4: What is CSRF (Cross-Site Request Forgery) and how is it mitigated in Express?
- Tricks users into submitting requests they didn't intend; mitigated with CSRF tokens or SameSite cookies (Correct answer)
- Forges server responses to steal user data; mitigated with HTTPS
- Injects scripts into server responses; mitigated with CSP headers
- Brute-forces login endpoints; mitigated with rate limiting
Correct answer: Tricks users into submitting requests they didn't intend; mitigated with CSRF tokens or SameSite cookies
CSRF attacks submit unauthorized requests using the victim's credentials; CSRF tokens embedded in forms or SameSite cookie attribute prevent cross-origin request forgery.
Question 5: What is NoSQL injection and how can it occur in a MongoDB/Express application?
- Sending malicious operators like $where or $gt in request bodies to manipulate MongoDB queries (Correct answer)
- Injecting SQL commands into MongoDB's aggregation pipeline
- Overwriting MongoDB documents with XSS payloads
- Flooding MongoDB with concurrent write operations
Correct answer: Sending malicious operators like $where or $gt in request bodies to manipulate MongoDB queries
NoSQL injection occurs when unvalidated user input is passed directly to MongoDB queries, allowing attackers to inject operators like $where or $regex to bypass authentication.
Question 6: What is the purpose of HTTPS in a MEAN stack deployment?
- Encrypts all data in transit between Angular clients and the Express server, protecting credentials and JWTs (Correct answer)
- Speeds up data transmission using HTTP/2 compression
- Enables WebSocket connections from Angular to Node.js
- Allows Angular to make cross-origin requests to the API
Correct answer: Encrypts all data in transit between Angular clients and the Express server, protecting credentials and JWTs
HTTPS uses TLS to encrypt all traffic between client and server, preventing man-in-the-middle attacks from intercepting JWTs, passwords, or sensitive API responses.
MEAN MEAN Stack Security and Deployment 1
What is JWT (JSON Web Token) and how is it used for authentication in a MEAN stack?