More in Node.js & Express — page 3
What is a Node.js Stream and why use one
WHAT IT TESTS: Understanding chunked processing and memory efficiency. OUTLINE: A stream processes data in chunks over time, so memory stays bounded and work starts before all data arrives; ideal for large files and network IO.
JWT storage: localStorage versus HttpOnly cookie
WHAT IT TESTS: Reasoning about XSS/CSRF trade-offs in token storage. OUTLINE: localStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
Prototype pollution: how it works and prevention
WHAT IT TESTS: Deep JS object-model security. OUTLINE: Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps.
Deploying a strict CSP for an Express SPA
WHAT IT TESTS: Real CSP rollout without unsafe-inline. OUTLINE: Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline.
Auditing and fixing vulnerable npm dependencies
WHAT IT TESTS: Practical dependency hygiene. OUTLINE: Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI.
Input validation versus output encoding
WHAT IT TESTS: Knowing these are complementary, not interchangeable. OUTLINE: Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control.
Preventing SQL injection with parameterized queries
WHAT IT TESTS: Knowing SQL injection and parameterization. OUTLINE: The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code.
Explaining and preventing CSRF in Express
WHAT IT TESTS: Understanding CSRF and the synchronizer-token pattern. OUTLINE: CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Preventing XSS when rendering user content in templates
WHAT IT TESTS: Knowing XSS and contextual output encoding. OUTLINE: The risk is XSS; default to escaped interpolation (EJS <%= %>, Pug #{}) so HTML is encoded, and avoid raw output (<%- %>) for untrusted data.
Purpose of Helmet middleware in Express
WHAT IT TESTS: Awareness of HTTP security headers and defense in depth. OUTLINE: Helmet sets safe response headers like X-Content-Type-Options, HSTS, and CSP, mitigating MIME-sniffing, clickjacking, and protocol downgrade.
Testing an async workflow that spans DB and message queue
WHAT IT TESTS: Verifying side effects that finish after the HTTP response. OUTLINE: Assert the DB row, then verify the queue message via a test consumer or spy, polling with a timeout rather than fixed sleeps.
Testing code that calls a third-party API
WHAT IT TESTS: How you fake external HTTP without real network calls. OUTLINE: Intercept at the HTTP boundary (nock) or run a local mock server; cover success, errors, timeouts, and assert request shape.
Managing clean test state across API integration tests
WHAT IT TESTS: How you keep integration tests isolated and fast. OUTLINE: Compare seed-and-truncate, per-test transaction rollback, and in-memory or containerized databases, weighing fidelity, speed, and isolation.
Testing async Promise-returning code in Jest
WHAT IT TESTS: Whether you make async assertions actually run before the test ends. OUTLINE: Return or await the promise; use await expect(...).resolves/rejects, or await the value directly.
Mocking the database layer in Jest unit tests
WHAT IT TESTS: Whether you isolate units from slow, stateful dependencies. OUTLINE: A live DB makes tests slow, flaky, and order-dependent; use jest.mock on the model so methods return controlled fakes.
Integration testing a POST endpoint with Supertest
WHAT IT TESTS: HTTP-level integration testing. OUTLINE: pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures.
Writing a basic Jest unit test
WHAT IT TESTS: Jest fundamentals. OUTLINE: import the function, group cases with describe, define each case with it or test, assert with expect and a matcher like toBe, covering normal and edge inputs.
Unit, integration, and E2E tests explained
WHAT IT TESTS: the test pyramid. OUTLINE: unit tests isolate one function with dependencies mocked, integration tests exercise several units together (route plus DB), E2E tests drive the whole running system.
Handling uncaughtException and unhandledRejection
WHAT IT TESTS: process-level last-resort error handling. OUTLINE: listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
Operational versus programmer errors in Node.js
WHAT IT TESTS: error classification and recovery policy. OUTLINE: operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.