Code reviewHardcr-g555

Subject Security missing rate limiting authLevel Senior–Staff~20 minCommon in Security · Networking & APIs interviewsIndustries Software development, Technology

Question

Review this Express login route.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjavascript

1app.post('/login', async (req, res) => {2  const { email, password } = req.body;3  const user = await Users.findByEmail(email);4  if (!user) return res.status(401).json({ error: 'invalid' });5  const ok = await bcrypt.compare(password, user.passwordHash);6  if (!ok) return res.status(401).json({ error: 'invalid' });7  const token = signJwt({ sub: user.id });8  res.json({ token });9});

Run or narrate your approach, then ask the coach.