Code reviewMediumcr-g556

Subject Security injection nosqlLevel Mid–Senior~18 minCommon in Security · Databases & SQL interviewsIndustries Software development

Question

Review this Node.js MongoDB authentication query.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjavascript

1app.post('/api/auth', async (req, res) => {2  // body parsed as JSON3  const user = await db.collection('users').findOne({4    username: req.body.username,5    password: req.body.password,6  });7  if (user) {8    req.session.uid = user._id;9    return res.json({ ok: true });10  }11  res.status(401).json({ ok: false });12});

Run or narrate your approach, then ask the coach.