▸case-01 We are launching a Node.js API that expects heavy traffic and needs defense against abuse. Could you outline a complete strategy for implementing request throttling and abuse prevention, including code snippets for user-based limits and response headers? | pass→fail | 28,852 | 36,104 | +25% | 1 | 1 | 0% | 4,418 | 5,077 | +15% | 0 | 0 | — |
▸case-02 We are configuring a Node.js REST API with JWT authentication. Developers suggest hardcoding a default fallback secret key in the auth service configuration code so local development works without setting environment variables. How should JWT signing secrets be managed? | pass→pass | 12,146 | 14,328 | +18% | 1 | 1 | 0% | 2,094 | 3,469 | +66% | 0 | 0 | — |
▸case-03 For our user registration API, team members want to enforce a 6-character minimum password length and hash passwords using simple MD5 or SHA1 for fast hashing performance. Evaluate this proposed setup and state the recommended security standard. | pass→pass | 13,754 | 11,557 | -16% | 1 | 1 | 0% | 1,936 | 2,970 | +53% | 0 | 0 | — |
▸case-04 An API endpoint `/users/:id/profile` retrieves user profile details. Currently, it checks if the requesting user has a valid JWT token, then directly executes `SELECT * FROM profiles WHERE id = req.params.id`. What authorization flaw is present and how must it be fixed? | pass→pass | 11,128 | 9,512 | -15% | 1 | 1 | 0% | 1,966 | 2,758 | +40% | 0 | 0 | — |
▸case-05 When a database error occurs during an Express.js API request, our backend currently catches the error and returns `{ status: 500, error: err.message, stack: err.stack }` to help clients debug. Assess this error handling strategy. | pass→pass | 12,619 | 10,672 | -15% | 1 | 1 | 0% | 2,173 | 2,792 | +28% | 0 | 0 | — |
▸case-06 We are writing a PostgreSQL database querying function in a Node.js backend. A teammate suggests string concatenation like `query = 'SELECT * FROM products WHERE category = ' + req.query.category` because ORMs are too slow. Provide the safe query implementation pattern. | pass→pass | 11,250 | 10,685 | -5% | 1 | 1 | 0% | 2,154 | 2,977 | +38% | 0 | 0 | — |
▸case-07 We are accepting JSON request payloads on a `/checkout` POST API endpoint in Node.js. Developers are currently writing custom `if (!req.body.amount)` checks scattered across controller functions. What structural pattern should be used for input validation? | fail→pass | 11,476 | 11,380 | -1% | 1 | 1 | 0% | 2,105 | 3,178 | +51% | 0 | 0 | — |
▸case-08 When returning HTTP responses from a rate-limited REST API endpoint, what standard HTTP response headers should be provided to inform clients about their current quota and reset window status? | pass→pass | 12,488 | 9,138 | -27% | 1 | 1 | 0% | 2,200 | 2,698 | +23% | 0 | 0 | — |
▸case-09 Our Node.js API needs to enforce rate limits per authenticated user account ID rather than per IP address, across multiple backend container instances. How should this rate limiter key and storage backend be configured? | pass→pass | 17,316 | 12,160 | -30% | 1 | 1 | 0% | 3,250 | 3,090 | -5% | 0 | 0 | — |
▸case-10 Our REST API endpoint `/api/v1/users` fetches database records using `SELECT * FROM users` and returns the JSON payload directly to the caller. What security issue exists and how should data serialization be handled? | pass→pass | 12,496 | 10,284 | -18% | 1 | 1 | 0% | 2,086 | 2,787 | +34% | 0 | 0 | — |
▸case-11 A team member proposes passing API secret keys as URL query parameters (e.g. `GET /api/v1/data?api_key=secret123`) so that frontend client scripts can make simple GET requests without setting custom headers. Evaluate this proposal. | pass→pass | 14,833 | 14,677 | -1% | 1 | 1 | 0% | 2,499 | 3,413 | +37% | 0 | 0 | — |
▸case-12 To make development fast and allow client web apps from multiple domains to connect to our Node.js API, a developer set the CORS header `Access-Control-Allow-Origin: *` while also setting `Access-Control-Allow-Credentials: true`. Evaluate this CORS configuration. | pass→pass | 11,696 | 9,694 | -17% | 1 | 1 | 0% | 1,998 | 2,692 | +35% | 0 | 0 | — |
▸case-13 Our REST API verifies incoming JWT tokens using a library where the algorithm option is not specified during verification (`jwt.verify(token, secret)`). A developer noticed clients can send tokens signed with algorithm 'none'. How should token verification be secured? | pass→pass | 9,879 | 13,457 | +36% | 1 | 1 | 0% | 1,785 | 3,403 | +91% | 0 | 0 | — |
▸case-14 To prevent Denial of Service attacks via payload flooding on an Express.js API accepting JSON payloads, what request parsing limits and HTTP header checks should be configured on the server? | pass→pass | 17,859 | 15,522 | -13% | 1 | 1 | 0% | 3,260 | 4,168 | +28% | 0 | 0 | — |
▸case-15 When security-sensitive REST API operations occur (such as password resets, failed login attempts, or permission changes), what information must be captured in audit logs without violating data privacy? | pass→pass | 16,745 | 20,486 | +22% | 1 | 1 | 0% | 2,610 | 4,090 | +57% | 0 | 0 | — |
▸case-16 We want to incorporate automated security checks into our Node.js API CI/CD pipeline to detect common vulnerabilities like OWASP Top 10 API security risks before deployment. What automated testing strategies or tooling categories should be integrated? | pass→pass | 22,592 | 22,633 | +0% | 1 | 1 | 0% | 4,060 | 5,171 | +27% | 0 | 0 | — |
▸case-17 We are deploying a GraphQL API endpoint (`/graphql`). A developer warns that malicious clients can construct deeply nested queries like `user { friends { friends { friends ... } } }` that crash the backend server. What security controls prevent this vulnerability? | pass→pass | 12,333 | 10,514 | -15% | 1 | 1 | 0% | 2,056 | 2,778 | +35% | 0 | 0 | — |
▸case-18 We are establishing a real-time WebSocket API for live updates using Node.js `ws`. Developers plan to accept any incoming connection and handle authentication inside message payloads after the connection opens. Assess this pattern and state the recommended authentication mechanism. | fail→fail | 16,825 | 12,544 | -25% | 1 | 1 | 0% | 2,788 | 3,090 | +11% | 0 | 0 | — |
▸case-19 Our REST API issues JWT access tokens that remain valid indefinitely so users never have to log back in. Evaluate this session management approach and describe the recommended token lifecycle pattern. | pass→pass | 14,354 | 15,281 | +6% | 1 | 1 | 0% | 2,370 | 3,527 | +49% | 0 | 0 | — |
▸case-20 We have an API endpoint `/api/v1/orders` that is running slowly due to missing indexes on the PostgreSQL `orders` table. Provide the SQL commands to create a composite B-tree index on `user_id` and `created_at` and explain how `EXPLAIN ANALYZE` helps measure execution time. | pass→pass | 11,650 | 8,985 | -23% | 1 | 1 | 0% | 2,191 | 2,765 | +26% | 0 | 0 | — |
▸case-21 We are building a web dashboard component using CSS Flexbox that displays user profile cards in a responsive grid. How do we configure `flex-wrap`, `justify-content`, and media queries so cards wrap cleanly on smaller viewports? | pass→pass | 16,422 | 12,618 | -23% | 1 | 1 | 0% | 3,244 | 3,422 | +5% | 0 | 0 | — |
▸case-22 On an Ubuntu Linux backend server hosting our API, how do we configure low-level kernel packet filtering using `iptables` to forward traffic from port 80 to port 8080 and drop raw ICMP ping packets? | pass→pass | 12,083 | 11,055 | -9% | 1 | 1 | 0% | 2,311 | 3,085 | +33% | 0 | 0 | — |