Skip to main content

Instructor walkthrough

Start and baseline​

From the repository root, export a fresh kit and run its starter:

node tooling/package-student-kit.mjs 06-security-misconfiguration node ./dist/misconfiguration-demo
cd dist/misconfiguration-demo/app
node --version
node checks.mjs
node server.mjs

Choose a new export destination if that folder already exists. Node must be 22+. The starter checks intentionally exit 1 because the error leaks diagnostics. The other checks should pass. Open http://127.0.0.1:3000.

Load working status returns 200 with status: "operational". Trigger simulated failure returns 503, public code SERVICE_UNAVAILABLE and fictional diagnostics:

{
  "service": "demo-campus-status",
  "path": "/fictional/campus/status-service.mjs",
  "detail": "Simulated upstream timeout (fictional)."
}

Discuss: the developer may find service/path useful; the visitor needs a safe explanation, not infrastructure details. These strings reveal nothing about the learner's machine.

Repair​

Keep the terminal in the exported kit's app folder used above. Edit that same folder's config.mjs, changing true to false. Save; Ctrl+C; run node server.mjs again from that folder. No quote marks around the boolean. The repository's canonical student starter remains unchanged.

Repeat both browser requests. The working response remains 200. Failure remains 503 with public message/code; diagnostics are absent. Stop the server and run node checks.mjs: all checks pass.

The checks make direct requests to an ephemeral local server. Removing diagnostics from the page cannot fool them. Refreshing without restart does not change the running server's imported configuration.

Answer guide​

  • Configuration versus dependency: behavior is controlled by a setting in our own app, not a known advisory against a third-party package.
  • Preserve failure status: removing diagnostics must not mislead the caller that the request succeeded.
  • Server boundary: any data sent can be read outside the supplied UI.
  • Scope: debug-off is one safeguard; real deployment also needs reviewed access controls, secrets management and safe operational logging.
  • Failure versus leak: the simulated upstream failure remains; the unnecessary disclosure is fixed.

If Node is unavailable, show supplied before/after examples and discuss the reasoning, but record that as a discussion exercise, not a verified hands-on run. Use rubric consistently.

Screenshot preview