Express & REST APIs — Chapter Quiz

Question 1

1

What does app.use(express.json()) do?

AAdds JSON support to console.logBParses JSON request bodies into req.bodyCReturns JSON responses by defaultDValidates JSON

express.json() is body-parsing middleware. Without it, req.body is undefined for JSON requests.

Question 2

2

What is the correct HTTP method for creating a resource?

AGETBPOSTCPUTDPATCH

POST creates. PUT is a full replace (idempotent). PATCH is a partial update. GET reads, DELETE removes.

Question 3

3

What status code means 'authentication failed / not authenticated'?

A400B401C403D404

401 = "who are you?" (not authenticated). 403 = "I know you, but you're not allowed."

Question 4

4

It's safe to use Access-Control-Allow-Origin: * with credentials.

TTrueFFalse

Browsers refuse to send cookies/auth with * origin. List explicit origins when you need credentials.

Question 5

5

What is the recommended password hashing function?

Asha256Bmd5Cbcrypt or argon2DPlain (with TLS)

Use a slow, salted, memory-hard KDF: bcrypt or argon2. Fast hashes (sha256, md5) are crackable at billions/sec on GPUs.

Question 6

6

Why validate request bodies with Zod (or similar)?

ATypeScript types are erased at runtime — they cannot validate untrusted inputBPerformanceCRequired by ExpressDIt is not necessary if you have tests

TS types vanish at compile time. An attacker sending unexpected shapes slips past TS. Validate at the boundary with a runtime schema (Zod, Joi).

Question 7

7

Express error-handling middleware has ___ arguments (special signature).

(err, req, res, next) — the 4-arg signature is how Express recognizes an error middleware. Mount it last.

Question 8

8

Which middlewares would you add to a production Express app?

Select all that apply.

Those four are middleware. jsonwebtoken is a library you use inside an auth middleware — it's not middleware itself.

Test what you learned.