Node.js Express.js & REST APIs 5 — Questions and Answers
Question 1: What is the purpose of the helmet middleware in an Express REST API?
- Rate limiting incoming requests
- Setting secure HTTP headers to reduce common vulnerabilities (Correct answer)
- Compressing response bodies
- Parsing multipart form data
Correct answer: Setting secure HTTP headers to reduce common vulnerabilities
Helmet sets security-related HTTP headers like Content-Security-Policy and X-Frame-Options automatically.
Question 2: What happens if you call next() inside a route handler after already sending a response with res.json()?
- The response is sent again, causing a duplicate body
- Express throws an uncaught exception immediately
- The next middleware may run and trigger a headers-already-sent error (Correct answer)
- Nothing happens; Express ignores the call
Correct answer: The next middleware may run and trigger a headers-already-sent error
Calling next() after res.send() causes downstream middleware to run and risks 'Cannot set headers after they are sent' errors.
Question 3: Which approach correctly handles async errors in an Express route in Express 4?
- Wrapping the handler in try/catch and calling next(err) (Correct answer)
- Using process.on('uncaughtException')
- Adding .catch() only at the server level
- Setting app.set('async', true)
Correct answer: Wrapping the handler in try/catch and calling next(err)
In Express 4 async handlers, try/catch with next(err) routes the error to Express error middleware since rejected promises are not caught automatically.
Question 4: What is content negotiation in the context of a REST API?
- Compressing response data based on client bandwidth
- The server selecting the response format based on the client's Accept header (Correct answer)
- Encrypting the response body for transport security
- Validating the request Content-Type before processing
Correct answer: The server selecting the response format based on the client's Accept header
Content negotiation uses the client's Accept header to determine whether to respond with JSON, XML, or another format.
Question 5: Which Express response method streams a file to the client with automatic Content-Type detection?
- res.json()
- res.write()
- res.sendFile() (Correct answer)
- res.pipe()
Correct answer: res.sendFile()
res.sendFile() sends a file at a given absolute path, automatically setting Content-Type and handling streaming.
Question 6: What does HATEOAS mean in REST API design?
- Hypermedia As The Engine Of Application State, embedding links so clients navigate APIs dynamically (Correct answer)
- HTTP Advanced Transfer Encoding Of Application Streams, used to compress payloads
- Hierarchical API Taxonomy Engine Of Addressable Services, used to version APIs
- Host-Aware Token Exchange Over Application Sessions, used to manage auth
Correct answer: Hypermedia As The Engine Of Application State, embedding links so clients navigate APIs dynamically
HATEOAS embeds hypermedia links in responses so clients can discover available actions without hard-coding endpoint URLs.
Question 7: When express.static('public') is used, what URL serves the file at public/images/logo.png?
- /static/images/logo.png
- /public/images/logo.png
- /images/logo.png (Correct answer)
- /logo.png
Correct answer: /images/logo.png
express.static strips the root directory name from the URL, so public/images/logo.png is served at /images/logo.png.
Node.js Express.js & REST APIs 5
What is the purpose of the helmet middleware in an Express REST API?