ExpressJS Advanced Topics in ExpressJS Syllabus

How is a JWT's signature verified, and what does it guarantee?

The signature is recomputed by hashing the header and payload with the secret/key and comparing it to the token's signature. It guarantees integrity and authenticity — that the token was not tampered with and was issued by the holder of the key.

What is the difference between stateful (session) and stateless (JWT) authentication?

Session auth stores state server-side and sends a session id cookie, requiring a server lookup each request. JWT auth is stateless: the token itself carries the claims and is verified by signature, needing no server-side session store, which aids scalability.

What common JWT claims do 'exp', 'iat', and 'sub' represent?

'exp' is the expiration time, 'iat' is the issued-at timestamp, and 'sub' is the subject (the principal/user the token is about). These are standard registered claims.

What is OAuth 2.0 and what problem does it solve?

OAuth 2.0 is an authorization framework that lets a third-party application obtain limited access to a user's resources without exposing the user's credentials. It delegates authorization via access tokens issued by an authorization server.

Describe the OAuth 2.0 Authorization Code flow at a high level.

The user is redirected to the provider to log in and consent; the provider redirects back with an authorization code; the server exchanges that code (plus its client secret) for an access token, then uses the token to call protected APIs.

What is the difference between authentication and authorization?

Authentication verifies who a user is (identity); authorization determines what an authenticated user is allowed to do (permissions/access). OAuth is primarily authorization; OpenID Connect adds authentication on top of OAuth.

What is OpenID Connect (OIDC) and how does it relate to OAuth 2.0?

OIDC is an identity/authentication layer built on top of OAuth 2.0. It adds an ID token (a JWT) that carries the user's identity claims, enabling 'sign in with' functionality that OAuth alone (authorization only) does not provide.

What is Cross-Site Scripting (XSS) and how is it prevented in Express apps?

XSS injects malicious scripts into pages viewed by other users. Prevent it by escaping/encoding output (default in EJS/Handlebars), validating and sanitizing input, and setting a Content-Security-Policy header.

What is SQL injection and how do you prevent it?

SQL injection sends malicious SQL through user input to manipulate queries. Prevent it with parameterized queries / prepared statements (or an ORM that parameterizes), plus input validation — never concatenate user input into SQL strings.

What is Cross-Site Request Forgery (CSRF) and a common defense?

CSRF tricks an authenticated user's browser into sending unwanted requests. Defenses include anti-CSRF tokens (synchronizer tokens), SameSite cookie attributes, and verifying the Origin/Referer header.

What is Helmet.js and what does it do?

Helmet.js is Express middleware that sets various security-related HTTP response headers (e.g. Content-Security-Policy, X-Content-Type-Options, Strict-Transport-Security) to protect the app from well-known web vulnerabilities.

Which key security headers does Helmet.js set by default?

By default Helmet sets headers such as Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options (frameguard), Strict-Transport-Security (HSTS), X-DNS-Prefetch-Control, and it removes the X-Powered-By header.

What does the Content-Security-Policy (CSP) header protect against?

CSP restricts which sources (scripts, styles, images, etc.) the browser may load and execute, mitigating XSS and data-injection attacks by disallowing untrusted or inline resources.

Why should you disable/remove the X-Powered-By header in Express?

By default Express advertises 'X-Powered-By: Express', revealing the stack to attackers. Removing it (app.disable('x-powered-by') or via Helmet) reduces fingerprinting and targeted attacks.

What is rate limiting and why is it used to secure Express apps?

Rate limiting caps how many requests a client can make in a time window (e.g. via express-rate-limit). It mitigates brute-force attacks, credential stuffing, and denial-of-service by throttling abusive traffic.

What is the purpose of input validation and sanitization middleware (e.g. express-validator)?

It checks that incoming data matches expected types/formats (validation) and strips or escapes dangerous content (sanitization), defending against injection, XSS, and malformed-data errors before the data reaches business logic.

What is caching and what are the main types relevant to a web server?

Caching stores copies of data/computations to serve future requests faster. Main types: client/browser caching, CDN/edge caching, reverse-proxy caching, in-memory application caching (e.g. Redis), and database query caching.

What is a cache hit ratio and how is it calculated?

The cache hit ratio measures how often requests are served from cache. It is calculated as $$\text{hit ratio} = \frac{\text{hits}}{\text{hits} + \text{misses}}$$ A higher ratio means better cache effectiveness.

Why is Redis commonly used as a caching layer with Express?

Redis is an in-memory key-value store offering very low-latency reads/writes, TTL-based expiration, and data structures. It is used to cache query results, sessions, and computed data, reducing load on primary databases.

What is the difference between cache TTL and cache invalidation?

TTL (time-to-live) automatically expires a cached entry after a set duration. Invalidation actively removes or updates cached entries when the underlying data changes, ensuring stale data is not served.

What do the HTTP Cache-Control and ETag headers do?

Cache-Control directives (e.g. max-age, no-cache, public/private) tell clients/proxies how and how long to cache a response. ETag is a validator/fingerprint the client sends back (If-None-Match) so the server can reply 304 Not Modified if unchanged.

What is load balancing and why is it needed for scaling Express apps?

Load balancing distributes incoming requests across multiple server instances to improve throughput, availability, and fault tolerance. It prevents any single instance from becoming a bottleneck as traffic grows (horizontal scaling).

Name common load-balancing algorithms.

Round-robin, weighted round-robin, least-connections, IP hash (source-based/sticky), and least-response-time. Each decides how requests are routed among backend servers.

What is the difference between horizontal and vertical scaling?

Vertical scaling (scaling up) adds more resources (CPU/RAM) to a single machine. Horizontal scaling (scaling out) adds more machine/process instances behind a load balancer. Node/Express typically scales horizontally due to its single-threaded event loop.

How does the Node.js cluster module or PM2 help scale an Express app on one machine?

They fork multiple worker processes (typically one per CPU core) that share the same server port, allowing the app to utilize all cores and balance connections across workers, since a single Node process runs on one thread.

What is a sticky session and when is it needed with load balancing?

A sticky (session-affinity) load balancer routes a given client's requests consistently to the same backend instance. It is needed when session state is stored in-process; using a shared store (e.g. Redis) removes this requirement.

What is application profiling and what does it measure?

Profiling analyzes a running application to measure resource usage — CPU time, memory allocation, function call frequency, and latency — to identify performance bottlenecks and inefficient code paths.

What is the difference between monitoring and profiling?

Monitoring continuously observes an app's health and metrics (uptime, error rates, latency, throughput) in production over time. Profiling is a deeper, usually short-term analysis of resource consumption to find specific bottlenecks.

What are the 'Four Golden Signals' of monitoring?

Latency (time to serve requests), Traffic (demand/throughput), Errors (rate of failed requests), and Saturation (how full a resource is). Popularized by Google's SRE practice for monitoring services.

Which tools are commonly used for monitoring Node.js/Express applications?

Prometheus with Grafana (metrics/dashboards), the New Relic and Datadog APM agents, PM2 monitoring, and OpenTelemetry for distributed tracing. Node's built-in --prof flag and clinic.js help with profiling.