All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
8664 bites
Page 18
Propagating async errors to Express error handlers
Express does not auto-catch rejected promises, so catch and call next(err), or wrap handlers in an asyncHandler that forwards rejections; Express 5 awaits handlers automatically.
Basic presence validation on a POST login route
Ensure the JSON body parser runs, destructure email and password from req.body, return 400 early if either is missing, then proceed.
JWT storage: localStorage versus httpOnly cookies
LocalStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated.
Strategies for revoking stateless JWTs
Short-lived access tokens with refresh-token rotation, or a server-side denylist of revoked token ids, weighing statelessness against immediacy.
Role-based access control middleware in Express
Authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes.
Securing Express with Passport local strategy
Configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions.
Session-based versus token-based authentication
Sessions store server-side state with a cookie id, tokens carry self-contained claims with no server store, weigh revocation versus scalability, especially across services.
JWT structure and how the signature works
Name header, payload, and signature, note the first two are base64url-encoded not encrypted, explain the signature is computed over header and payload with a secret to detect tampering.
Authentication versus authorization in Express
Authentication proves who you are, authorization decides what you may do, authentication happens first.
MongoDB aggregation pipeline for total sales
Explain the pipeline as ordered stages, use $group with $sum to total per productId, $match on the computed total, then $sort descending.
Atomic order creation with Sequelize transactions
Wrap dependent writes in sequelize.transaction, pass the transaction to each query, let managed transactions auto-commit or roll back.
Solving the N+1 query problem in Sequelize
Define N+1 as one parent query plus one per child, detect it via SQL logging, fix with eager loading using include.
Mongoose pre('save') hooks for password hashing
Pre('save') runs before persistence; use it to hash the password, guarding with isModified, calling next() or returning.
Database migrations with the Sequelize CLI
Migrations are version-controlled scripts with up/down so teams apply identical schema changes; use sequelize-cli to generate, edit with addColumn, then db:migrate.
Mongoose populate() for referenced documents
Populate() replaces stored ObjectIds with the referenced documents, needs a ref in the schema, called via .populate('author').
Define a Mongoose schema and model
New mongoose.Schema with field options (type, required, default), then mongoose.model('Product', schema) to get a model.
API versioning: URL vs header strategies
Version via URL path (/v1/), a custom or Accept header, or a query param; URL is visible and cache-friendly, headers keep URLs clean but are less discoverable.
Centralized error handling in an Express API
A final four-arg error middleware, an asyncHandler wrapper to funnel promise rejections via next, a custom error class with statusCode, returning uniform JSON.
404 vs 500: missing resource vs server failure
A missing resource returns 404 Not Found (client asked for something absent); a database failure returns 500 Internal Server Error (server-side fault).
Idempotency: PUT vs POST in REST
Idempotent means repeated identical requests leave the same server state; PUT is idempotent, POST is not. Use PUT to overwrite a resource at a known URL.