Teaching plan: Security Misconfiguration

Audience and objective

Beginners with basic familiarity with files and an editor; no previous Node server programming required. Provide Node.js 22+ before class. Exercise05 is optional, not a prerequisite.

Students will distinguish useful public error information from internal diagnostics, repair one configuration boolean, verify actual HTTP responses and explain why client-side concealment is inadequate.

Preparation

1. Read walkthrough, rubric and solution.
2. Test the starter and solution on a representative lab computer.
3. Export a new student-only kit from the repository root: node tooling/package-student-kit.mjs 06-security-misconfiguration node ./dist/misconfiguration-class.
4. Confirm the kit runs independently from its app folder. Never distribute a kit you already repaired during testing as an untouched starter.
5. Decide whether to withhold the public solution until discussion. The exporter excludes instructor files and solutions.
6. Confirm localhost servers are permitted by your lab policy. Do not expose the starter to the network.
7. Specify the submission format and deadline in your course system. Accept the completed Markdown template or your normal document format, with four response captures and full check output. Tell pairs whether each learner submits their own explanation. No separate app ZIP is needed unless you request it.

Suggested 60–75 minutes after setup

Time	Teaching focus
0–10	Browser/server, settings, JSON, debug mode, 200 versus 503; predict safe output.
10–25	Observe both requests; identify fictional internal details.
25–40	Inspect config, disable debug, save and restart.
40–55	Repeat both requests, run direct HTTP checks, capture evidence.
55–75	Explain the security boundary, discuss limitations, complete submission.

Allow additional setup support separately.

Facilitation

The small code edit is intentional; reasoning and verification are the lesson. Model opening the correct folder and the difference between refreshing a page and restarting a server. Use paired work if terminal use is new.

Pause before the repair to confirm everyone has saved both baseline responses: each button replaces the display. Ask a learner to point to the HTTP status and the separate public error code. At the end, ask why a passing check can still expect 503, and why a server restart matters. These checks distinguish understanding from copying a one-line answer.

For quicker groups, discuss a different example: a public error contains a database hostname and a generic retry message. Which information belongs in the public response, and who should have access to detailed diagnostics? Do not ask learners to build a logging system or inspect a real target.

Do not ask learners to find real targets or add actual secrets. No AI account, scanner installation or browser developer-tools expertise is required. Network-panel inspection can be an optional demonstration after the core task.

Assess using the supplied 20-point rubric. A correct boolean without explanation is incomplete evidence. Describe this as an example of A02 Security Misconfiguration, not every A02 weakness or a CVE Lite detection capability.