All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
4330 bites
Page 73
Mocking the database layer in Jest unit tests
A live DB makes tests slow, flaky, and order-dependent; use jest.mock on the model so methods return controlled fakes.
Testing async Promise-returning code in Jest
Return or await the promise; use await expect(...).resolves/rejects, or await the value directly.
Managing clean test state across API integration tests
Compare seed-and-truncate, per-test transaction rollback, and in-memory or containerized databases, weighing fidelity, speed, and isolation.
Testing code that calls a third-party API
Intercept at the HTTP boundary (nock) or run a local mock server; cover success, errors, timeouts, and assert request shape.
Testing an async workflow that spans DB and message queue
Assert the DB row, then verify the queue message via a test consumer or spy, polling with a timeout rather than fixed sleeps.
Purpose of Helmet middleware in Express
Helmet sets safe response headers like X-Content-Type-Options, HSTS, and CSP, mitigating MIME-sniffing, clickjacking, and protocol downgrade.
Preventing XSS when rendering user content in templates
The risk is XSS; default to escaped interpolation (EJS <%= %>, Pug #{}) so HTML is encoded, and avoid raw output (<%- %>) for untrusted data.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Preventing SQL injection with parameterized queries
The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code.
Input validation versus output encoding
Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control.
Auditing and fixing vulnerable npm dependencies
Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI.
Deploying a strict CSP for an Express SPA
Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline.
Prototype pollution: how it works and prevention
Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
What is a Node.js Stream and why use one
A stream processes data in chunks over time, so memory stays bounded and work starts before all data arrives; ideal for large files and network IO.
Purpose of the Node.js cluster module
Cluster forks worker processes sharing one listening port, so requests spread across CPU cores via the OS, raising throughput and adding resilience.
Offloading CPU work with worker_threads
Heavy sync work blocks the single event loop and stalls all requests; move it to a Worker, message the input, await the result asynchronously, and ideally pool workers.
worker_threads versus cluster: when to use each
Worker_threads offloads CPU-bound compute within one process with shared-memory transfer; cluster forks processes to scale IO-bound request throughput across cores.
Implementing a custom filtering Transform stream
Subclass Transform with objectMode, implement _transform to parse each chunk, push only matching objects, and call the callback; handle parse errors.
How does Node.js cluster module enable zero-downtime restarts?
Master-worker architecture, graceful shutdown of old workers, routing new requests to new workers.