Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Which specific Express middleware is designed to prevent Brute Force password guessing and Denial of Service (DDoS) attacks by restricting the number of requests an IP address can make?
💻 Code Challenge | +75 XP
Write the Node.js/Backend code snippet to implement a Node Security: CORS, Rate Limiting, Headers HTTP pipeline. Include the setup and basic execution steps.
You are reviewing a Node Security: CORS, Rate Limiting, Headers HTTP pipeline and the output is incorrect. Reorder the following pipeline stages in the correct logical order to fix the bug: Input Data, Process, Output.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Believing CORS protects the API from malicious requests, not just browser-based ones
// CORS does NOT block this — it's not a browser
// $ curl https://your-api.com/admin/users
// Actual protection has to come from auth + rate limiting middleware,
// not from app.use(cors({ origin: 'https://your-frontend.com' }))The Solution //
CORS is enforced entirely by the browser — it does nothing to stop a request made with curl, Postman, or a Python script, since those tools simply ignore CORS response headers. Treat CORS purely as a browser-to-browser trust boundary and rely on authentication, authorization, and rate limiting (not CORS) to actually protect the API from scripted attacks.
The Error //
Setting origin: '*' in CORS config for an API that also accepts credentials (cookies/auth headers)
// Wrong: browsers will actually reject this combination
app.use(cors({ origin: '*', credentials: true }));
// Correct: explicit origin whitelist
app.use(cors({ origin: ['https://app.example.com'], credentials: true }));The Solution //
A wildcard origin combined with credentials: true is rejected by browsers for good reason — it would let literally any website make authenticated requests on behalf of a logged-in user. Explicitly whitelist known frontend origins (or validate against an array of allowed origins) whenever the API needs to accept cookies or Authorization headers.