Authentication, Sessions & Web Security
Authentication state, cookies, API protection, security middleware, and common web attacks.
Q39: How does JWT authentication work in a Node.js REST API?
JSON Web Tokens (JWT) contain encoded JSON claims signed with a secret or key. The server verifies the token sent in the Authorization header (Bearer <token>) on subsequent requests.
- Stateless authentication mechanism for RESTful APIs.
- Tokens are signed to prevent client-side tampering.
Which HTTP header is standard for passing JWT tokens?
Q40: What is the difference between session-based and token-based state storage?
Session authentication stores state server-side (in memory or Redis) mapped to a session ID cookie. Token-based authentication (JWT) stores cryptographically signed state client-side.
- Sessions store state server-side relying on session ID cookies.
- Tokens store state statelessly within signed user tokens.
Which data store is popular for managing distributed server-side sessions?
Q42: How do you implement rate limiting in a Node.js API?
Rate limiting restricts repeated requests from single IP addresses within time windows. Libraries like express-rate-limit backed by Redis record request frequencies.
- Protects endpoints against brute-force and Denial of Service (DoS) attacks.
- Stores request counters in memory or distributed Redis instances.
Which HTTP status code is standard for rate limit policy violations?
Q43: What is Helmet.js and why should Express applications use it?
Helmet.js is Express security middleware that sets various HTTP response headers (like Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) to guard against common web vulnerabilities.
- Secures HTTP headers automatically in Express apps.
- Mitigates attacks like clickjacking, XSS, and MIME sniffing.
Which security risk is mitigated by setting X-Frame-Options via Helmet?
Q44: What is HTTP Response Splitting and how does Node.js defend against it?
HTTP Response Splitting occurs when untrusted user input containing carriage return (\r) and line feed (\n) characters is injected into HTTP response headers, allowing attackers to inject arbitrary headers or split responses. Node.js mitigates this by automatically throwing an error (ERR_INVALID_HTTP_TOKEN) if header keys or values contain CRLF characters.
- CRLF injection allows attackers to inject malicious headers or manipulate HTTP body content.
- Node.js enforces strict internal header character validations to block CRLF injection attempts.
Which character combination is used in HTTP Response Splitting attacks to inject unauthorized headers?
Q45: What is Prototype Pollution and how do you protect Node.js applications against it?
Prototype Pollution occurs when an attacker modifies the base JavaScript Object.prototype by injecting properties through recursive object merging or path traversal keys like __proto__ or constructor.prototype. To prevent it, use Object.create(null) for plain key-value maps, freeze prototypes with Object.freeze(), validate JSON input schemas, or use modern map structures like Map.
- Prototype Pollution manipulates
Object.prototypeto inject unintended properties globally. - Mitigate using
Object.create(null), input validation libraries, orMapdatatypes.
Which object creation approach produces an object completely free from Object.prototype inheritance?