NodeJS Security Syllabus

Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security in NodeJS, not a summary of it.

1. 1

   Authentication

   3 topics

   • JWT (JSON Web Tokens)
   • OAuth
   • PassportJS
2. 2

   Data Validation

   2 topics

   • Joi
   • Validator.js
3. 3

   Common Security Practices

   3 topics

   • Helmet
   • Rate Limiting
   • CORS

Security flashcards for NodeJS

23 of 50 cards from the Security deck — real questions with worked answers.

1. What does JWT stand for, and what is its core purpose?

   JWT stands for JSON Web Token. It is a compact, URL-safe, self-contained token format (RFC 7519) used to securely transmit claims between parties as a digitally signed JSON object, commonly for stateless authentication and authorization.

2. What are the three parts of a JWT, and how are they separated?

   A JWT has three Base64URL-encoded parts separated by dots: Header.Payload.Signature. The header declares the token type and signing algorithm, the payload holds the claims, and the signature verifies integrity.

3. How is a JWT signature computed for an HMAC-based algorithm like HS256?

   The signature is HMAC-SHA256 over the encoded header and payload using a secret key: $$\text{signature} = \text{HMACSHA256}\big(\text{base64url}(header) + \texttt{.} + \text{base64url}(payload),\; secret\big)$$

4. In JWT, what is the difference between symmetric (HS256) and asymmetric (RS256) signing?

   HS256 uses a single shared secret for both signing and verification (HMAC). RS256 uses an RSA private key to sign and a public key to verify, so verifiers never need the signing secret. Use RS256 when multiple/untrusted services must verify tokens.

5. List common JWT registered (standard) claims and their meaning.

   iss (issuer), sub (subject/user), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (unique token ID). These are optional but standardized reserved claim names.

6. Is data inside a standard (signed) JWT confidential? Why or why not?

   No. A signed JWT (JWS) only guarantees integrity and authenticity, not confidentiality; the payload is Base64URL-encoded, not encrypted, so anyone can decode it. For confidentiality you must use JWE (encrypted JWT) or transport over TLS and avoid storing secrets in the payload.

7. What is the critical JWT vulnerability related to the alg header, and how is it prevented?

   The alg:none / algorithm-confusion attack: an attacker sets the header algorithm to none (unsigned) or swaps RS256 for HS256 to trick verification. Prevent it by explicitly whitelisting the expected algorithm(s) on verification and never trusting the alg field from the token.

8. Explain the access token vs refresh token pattern in JWT-based auth.

   An access token is short-lived (e.g. minutes) and sent with each request to authorize API access. A refresh token is long-lived and stored securely; when the access token expires, the client presents the refresh token to obtain a new access token without re-logging in.

9. Why are JWTs described as stateless, and what is the tradeoff for revocation?

   They are stateless because the server validates a token by checking its signature and claims without a session store lookup. The tradeoff: you cannot easily revoke a valid unexpired JWT, so revocation requires short expiry, a denylist/blocklist, or a token-version check.

10. What is OAuth 2.0, and what problem does it solve?

    OAuth 2.0 is an authorization framework (RFC 6749) that lets a third-party application obtain limited access to a user's resources on another service without the user sharing their password. It issues scoped access tokens instead of exposing credentials.

11. Name the four roles defined in the OAuth 2.0 framework.

    Resource Owner (the user), Client (the app requesting access), Authorization Server (issues tokens after authenticating the owner), and Resource Server (hosts the protected resources and accepts access tokens).

12. What is the key distinction between authentication and authorization, and which does plain OAuth 2.0 provide?

    Authentication verifies who a user is; authorization determines what an entity is allowed to do. OAuth 2.0 is an authorization framework. Authentication on top of it is provided by OpenID Connect (OIDC), which adds an ID token.

13. Describe the OAuth 2.0 Authorization Code grant flow at a high level.

    The client redirects the user to the authorization server, the user authenticates and consents, the server redirects back with a short-lived authorization code, and the client exchanges that code (server-to-server, with its client secret) for an access token.

14. What is PKCE in OAuth 2.0, and why is it used?

    PKCE (Proof Key for Code Exchange, RFC 7636) secures the Authorization Code flow for public clients (SPAs, mobile). The client sends a hashed code_challenge up front and the plain code_verifier at token exchange, preventing authorization-code interception attacks. It is now recommended for all clients.

15. What is the difference between an OAuth access token and an OIDC ID token?

    An access token authorizes API calls to the resource server (opaque to the client). An ID token is a JWT issued by OpenID Connect that authenticates the user and contains identity claims (sub, name, email) meant to be consumed by the client.

16. What are OAuth scopes?

    Scopes are strings that define and limit the specific permissions an access token grants (e.g. read:profile, write:email). They implement least-privilege by restricting what the client can do on the resource server.

17. Which OAuth 2.0 grant type is recommended for machine-to-machine (no user) access?

    The Client Credentials grant, where the client authenticates with its own client ID and secret to obtain an access token for its own resources, with no resource-owner involvement.

18. What is PassportJS?

    Passport is authentication middleware for Node.js/Express. It provides a unified API to authenticate requests using pluggable 'strategies' (local, JWT, OAuth providers, etc.), decoupling auth logic from the application.

19. In PassportJS, what is a 'strategy'?

    A strategy is a pluggable module that implements a specific authentication mechanism (e.g. passport-local for username/password, passport-jwt for JWTs, passport-google-oauth20 for Google). You configure strategies and Passport delegates authentication to them.

20. What do serializeUser and deserializeUser do in PassportJS?

    serializeUser determines what user data (typically the user ID) is stored in the session after login. deserializeUser takes that stored identifier on subsequent requests and retrieves the full user object, attaching it to req.user. They are only needed for session-based auth.

21. How is the passport-local strategy's verify callback expected to signal outcomes?

    The verify callback receives credentials and calls done(err, user, info): done(err) for an error, done(null, false, info) when authentication fails (bad credentials), and done(null, user) on success.

22. How does PassportJS attach the authenticated user to a request?

    After a successful authentication, Passport populates req.user with the authenticated user object, making it available to downstream route handlers and middleware.

23. What is Joi, and what is it used for in Node.js?

    Joi is a schema description and data validation library. You build a schema describing the shape and constraints of data (types, required fields, ranges, patterns) and validate incoming objects (like request bodies) against it, returning errors or validated values.

See more Security flashcards →

Planning Security for NodeJS

Security (NodeJS) FAQ