Code reviewHardcr-g550

Subject Security mass assignmentLevel Senior–Staff~20 minCommon in Security interviewsIndustries Software development

Question

Review this Express handler that updates a user profile.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjavascript

1app.patch('/api/users/:id', requireAuth, async (req, res) => {2  const { id } = req.params;3  if (req.user.id !== id) return res.status(403).end();4  // merge whatever fields the client sent5  const updated = await User.findByIdAndUpdate(6    id,7    { $set: req.body },8    { new: true }9  );10  res.json(updated);11});

Run or narrate your approach, then ask the coach.