Code reviewHardcr-g034

Subject Auth bypassLevel Senior–Staff~30 minCommon in Security interviewsIndustries Software development

Question

Review this Node.js JWT verification middleware.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjs

1const jwt = require('jsonwebtoken');2 3function authenticate(req, res, next) {4  const token = (req.headers.authorization || '').replace('Bearer ', '');5  try {6    const payload = jwt.verify(token, PUBLIC_KEY);7    req.user = payload;8    next();9  } catch {10    return res.status(401).json({ error: 'unauthorized' });11  }12}

Run or narrate your approach, then ask the coach.