🔐 Project 5: REST API + Auth

Chapter: Node.js & Express — Backend APIs · Level ★★★ · Time: 90 min

SCORE___ / 20

NameClassDate

After this worksheet you can

Combine Express, Mongoose, JWTScope resources to a userHandle unauthorized requestsProtect secrets in .env

📚 Quick Recap

🎯 What you'll practice: Planning a fully authenticated backend, combining Lessons 25–27.

🧮 Section B · Problem Solving ● INTERMEDIATE 2 + 3×3 = 11

5The field never returned in an API response is .

6req. is set by the protect middleware after verifying the token.

7Write a query that only returns tasks belonging to req.user.id.

8How do you prevent user A from deleting user B's task via the API?

9Why must the register route hash the password before saving, even for a project that's "just practice"?

🚀 Section C · Challenge ● CHALLENGE 5

10Design the full DELETE /api/tasks/:id route: check ownership before deleting, and return the correct status codes for each outcome (success, not found, not owner).

💭 Reflection — the most useful thing I learned:

A ___/4 B ___/11 C ___/5 Total ___/20 Teacher's Signature Parent's Signature

✂ answer key — fold or cut before handing out

1-B 2-B 3-B 4-B | 5 = password 6 = user 7 = Task.find({userId: req.user.id}); 8 = Load the task, compare task.userId to req.user.id, and return 403 (or 404) if they don't match, before performing the delete 9 = Because storing plain-text passwords is a real security habit being learned — even practice projects should follow production-safe patterns since bad habits carry into real applications | 10 = app.delete('/api/tasks/:id',protect,async(req,res)=>{const t=await Task.findById(req.params.id);if(!t)return res.status(404).json({error:'Not found'});if(t.userId.toString()!==req.user.id)return res.status(403).json({error:'Forbidden'});await t.deleteOne();res.status(204).send();});

📄 Need offline practice?Print this worksheet or open the one-page cheat sheet.

🗒 Cheat Sheet

🧠 Section A · Concept Check ● BEGINNER 4 × 1 = 4

🧮 Section B · Problem Solving ● INTERMEDIATE 2 + 3×3 = 11

🚀 Section C · Challenge ● CHALLENGE 5