NodeJS Security Syllabus

How is the passport-local strategy's verify callback expected to signal outcomes?

The verify callback receives credentials and calls done(err, user, info): done(err) for an error, done(null, false, info) when authentication fails (bad credentials), and done(null, user) on success.

How does PassportJS attach the authenticated user to a request?

After a successful authentication, Passport populates req.user with the authenticated user object, making it available to downstream route handlers and middleware.

What is Joi, and what is it used for in Node.js?

Joi is a schema description and data validation library. You build a schema describing the shape and constraints of data (types, required fields, ranges, patterns) and validate incoming objects (like request bodies) against it, returning errors or validated values.

Write a basic Joi schema that validates an object with a required string username (3-30 chars) and a required email.

const schema = Joi.object({ username: Joi.string().min(3).max(30).required(), email: Joi.string().email().required() });

What is the difference between schema.validate() and schema.validateAsync() in Joi?

validate() runs synchronously and returns an object { value, error }. validateAsync() returns a Promise that resolves to the validated value or rejects with a ValidationError, and it is required when the schema uses async rules like external() references.

In Joi, what does the abortEarly option control?

By default abortEarly is true, so validation stops and reports only the first error. Setting { abortEarly: false } collects and returns all validation errors in the details array, which is useful for showing every form error at once.

What is Validator.js, and how does it differ from Joi?

Validator.js is a library of string validation and sanitization functions (e.g. isEmail, isURL, isUUID, normalizeEmail). It validates individual string values, whereas Joi validates entire structured objects against a declarative schema.

Name five common Validator.js validation functions and what they check.

isEmail (valid email format), isURL (valid URL), isUUID (valid UUID), isLength (string length within bounds), and isNumeric / isInt (numeric or integer strings). Validator.js operates on string inputs.

What is the difference between validation and sanitization, and which does Validator.js support?

Validation checks whether input meets rules and returns a boolean; sanitization transforms/cleans input into a safe canonical form. Validator.js supports both, with validators (isX) and sanitizers (e.g. trim, escape, normalizeEmail, toBoolean).

What is Helmet in Express, and what does it do?

Helmet is Express middleware that sets a collection of HTTP security response headers with safe defaults to help protect the app from common web vulnerabilities (XSS, clickjacking, MIME sniffing, etc.). You add it with app.use(helmet()).

Which HTTP header does Helmet set to mitigate clickjacking, and what does it do?

X-Frame-Options (set to SAMEORIGIN or DENY). It controls whether the page may be rendered inside a frame/iframe, preventing clickjacking by disallowing the site from being embedded by other origins.

What is Content-Security-Policy (CSP), and how does Helmet relate to it?

CSP is a header that whitelists the sources from which resources (scripts, styles, images) may load, mitigating XSS and injection. Helmet can set the Content-Security-Policy header (via helmet.contentSecurityPolicy()), though it must usually be configured explicitly for your app.

What does the Strict-Transport-Security (HSTS) header do, and does Helmet set it?

HSTS tells browsers to only communicate with the site over HTTPS for a specified max-age, preventing protocol-downgrade and SSL-stripping attacks. Helmet enables it by default via helmet.hsts().

What is the purpose of the X-Content-Type-Options: nosniff header set by Helmet?

It instructs the browser not to MIME-sniff (guess) a response's content type and to trust the declared Content-Type, preventing attacks where a file is interpreted as a different, executable type (e.g. treating an upload as a script).

What is rate limiting, and why is it used?

Rate limiting caps how many requests a client (usually identified by IP or API key) can make in a given time window. It protects against brute-force attacks, credential stuffing, denial-of-service, and API abuse, and helps ensure fair resource usage.

In a fixed-window rate limiter, how do you express the allowed request rate?

As a maximum count of requests per window: $$\text{rate} = \frac{\text{max requests}}{\text{window duration}}$$ e.g. $\frac{100\ \text{requests}}{15\ \text{minutes}}$. Once the counter reaches max within the window, further requests are rejected until the window resets.

Compare the fixed-window and sliding-window rate-limiting algorithms.

Fixed window counts requests in discrete time buckets and resets at each boundary, but allows bursts of up to 2x the limit around the boundary. Sliding window smooths this by weighting the previous window's count, giving a more accurate rolling rate at higher computational cost.

Explain the token bucket rate-limiting algorithm.

A bucket holds up to a capacity of tokens and refills at a fixed rate r tokens per second. Each request consumes one token; if the bucket is empty the request is throttled. It permits short bursts (up to bucket capacity) while enforcing an average rate over time.

Which HTTP status code and headers typically signal a rate-limit rejection?

HTTP 429 Too Many Requests. Servers often add a Retry-After header (seconds until retry) and informational headers like RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset.

Why should a distributed/multi-instance API store rate-limit counters in a shared store like Redis?

Because in-memory counters are per-process, so with multiple server instances each would track its own count, letting a client exceed the intended global limit. A shared store (e.g. Redis) gives a single authoritative counter across all instances.

What is CORS, and what problem does it address?

CORS (Cross-Origin Resource Sharing) is a browser security mechanism using HTTP headers that lets a server relax the Same-Origin Policy and explicitly permit web pages from other origins to access its resources. It controls cross-origin browser requests, not server-to-server calls.

How is an 'origin' defined for the Same-Origin Policy and CORS?

An origin is the tuple of scheme (protocol) + host + port. Two URLs share an origin only if all three match; any difference (e.g. http vs https, different subdomain, or different port) makes them cross-origin.

Which response header is central to CORS, and what does it specify?

Access-Control-Allow-Origin. It tells the browser which origin(s) are permitted to read the response, either a specific origin (e.g. https://app.example.com) or the wildcard * (which cannot be used with credentials).

What is a CORS preflight request, and when is it triggered?

A preflight is an automatic OPTIONS request the browser sends before the actual 'non-simple' request to ask permission. It is triggered by non-simple methods (PUT, DELETE, PATCH), custom headers, or certain Content-Types, and the server must answer with the appropriate Access-Control-Allow-* headers.

What defines a CORS 'simple request' that does not require a preflight?

A simple request uses GET, HEAD, or POST; includes only CORS-safelisted headers; and, for POST, uses a Content-Type of application/x-www-form-urlencoded, multipart/form-data, or text/plain. Such requests skip the preflight OPTIONS step.

How do you allow credentials (cookies/authorization headers) in CORS, and what constraint applies?

Set Access-Control-Allow-Credentials: true and have the client send credentials. The constraint: Access-Control-Allow-Origin must then be an explicit origin, not the wildcard *, or the browser will block the response.

Which CORS response headers govern allowed methods and headers on preflight, plus preflight caching?

Access-Control-Allow-Methods lists permitted HTTP methods, Access-Control-Allow-Headers lists permitted request headers, and Access-Control-Max-Age sets how long (seconds) the browser may cache the preflight result to avoid repeating it.

Is CORS a defense against server-side attacks like CSRF or a substitute for authentication? Explain.

No. CORS is enforced by the browser and only governs whether cross-origin JavaScript can read a response; it is not authentication or authorization and does not by itself stop CSRF. Non-browser clients ignore CORS entirely, so servers still need proper auth and CSRF protections.

Compare Joi and Validator.js in terms of scope and typical use case.

Joi validates whole structured objects against a declarative schema (great for validating request bodies/config). Validator.js provides individual string validators and sanitizers (great for checking or cleaning a single field like an email). They are often complementary.

Contrast session-based authentication with stateless JWT authentication.

Session-based auth stores session state server-side and gives the client a session ID cookie, requiring a server lookup per request but allowing easy revocation. JWT auth is stateless: the token itself carries signed claims, so no server store is needed, but tokens are harder to revoke before expiry.