ExpressJS

Question 1

Create simple express app (without routes) that will listen on port 7777

Answer 1

import express from 'express';

const app = express();

  app.listen(7777, () => {
    console.log(
      `Express started on http://localhost:${port}` +
        "; press Ctrl-C to terminate."
    );
  });

Question 2

What is a middleware

Answer 2

Functions called before handling each request

Question 3

In what order middlewares are executed

Answer 3

Middleware is executed in what’s known as a pipeline - functions that are loaded first are also executed first.

Question 4

How to use a middlware (e.g. from a library).

Answer 4

app.use(foo)

Question 5

How to parse JSON body

Answer 5

app.use(express.json())

Question 6

What are middleware function signatures

Answer 6

function (err, req, res, next)
- Error middleware

function(req, res, next)
- Regular middleware

Question 7

How to handle different requests (POST, PUT, DELETE) on /

Answer 7

app.post('/', (req, res) = {});
app.put('/', (req, res) = {});
app.delete('/', (req, res) = {});

Question 8

How to access name field in JSON passed to an endpoint.

Answer 8

req.body.name;

Question 9

How to access parameter q passed in URL (example For "GET /search?q=tobi+ferret" => "tobi ferret"

Answer 9

req.query.q;

Question 10

Send JSON response from endpoint

Answer 10

res.json();

Question 11

Send any response from endpoint with status code 500

Answer 11

res.status(500).send();

Question 12

Redirect to another endpoint

Answer 12

res.redirect();

Question 13

Set header in endpoint response

Answer 13

res.set("Content-Type", "text/html");

Question 14

Routing - Handle routes starting with '/api/members' with router in './routes/api/members.js' module. How to define a router

Answer 14

```javascript
app.use(“/api/members”, require(“./routes/api/members”));

const router = express.Router();

// Handle ‘/api/members’
router.get(“/”, (req, res) => {});

export router;
~~~

Question 15

How cookies work? What headers are used?

Answer 15

• When the server wants the client to store a cookie, it sends a header called Set-Cookie containing name/value pairs.
• When a client sends a request to a server for which it has cookies, it sends multiple Cookie request headers containing the value of the cookies.

Question 16

List cookie options (at least the most important ones)

Answer 16

domain

• Allows you to assign cookies to specific subdomains.
• Note that you cannot set a cookie for a different domain than the server is running on.

path

• Controls the path this cookie applies to.
• If you use a path of / (the default), it will apply to all pages on your site. If you use a path of /foo, it will apply to the paths /foo, /foo/bar, etc.

maxAge

• How long the client should keep the cookie before deleting it, in milliseconds
• If you omit this, the cookie will be deleted when you close your browser.

secure

• Specifies that this cookie will be sent only over a secure (HTTPS) connection.

httpOnly

• Setting this to true specifies the cookie will be modified only by the server (frontend JS cannot modify it)
• This helps prevent XSS attacks.

signed

• Setting this to true signs this cookie, making it available in res.signedCookies instead of res.cookies
• Signed cookies that have been tampered with will be rejected by the server, and the cookie will be moved from res.signedCookies to res.cookies

Question 17

How sessions work

Answer 17

• To implement sessions, something has to be stored on the client.
• The usual method of doing this is a cookie that contains a unique identifier (SID).
• Other way to maintain state in the past was decorating URLs with session information - but this is way obsolete now.
• HTML5 provides another option for sessions called local storage, which offers an advantage over cookies if you need to store larger amounts of data.

Question 18

How to protect express app against CSRF attacks?

Answer 18

• Always check content type application/json in REST API.
• Or, use only GET (no side-effect on the server), and replace POST with PUT, PATCH, DELETE (so it’s covered with CORS).
• Use csurf that provides CSRF Token support.

Question 19

How to configure CORS for an app?
- Allow all
- Allow single domain

Answer 19

const cors = require("cors");

// Allow all requests (i.e. public API)
app.use(
  cors({
    origin: "*",
  })
);
// it's same as
app.use(cors());

app.use(
  cors({
    origin: "domain-b.com",
  })
);