An error

Nothing

Only “Alice” is rendered.

Only “Loading...” is rendered.

Both “Loading...” and “Alice” are rendered.

Nothing is rendered.

The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.

The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.

The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.

It is safe because email and password are both checked in a single query.

It is secure as long as HTTPS is used.

It is vulnerable because user-controlled values are used directly in the query, allowing operators like $ne.

It correctly uses bcrypt under the hood.

The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.

It only checks the status code and ignores the body.

It checks that the route responds with status 201 and a body containing name:"Alice".

It cannot run unless the server is listening on a physical port.

It is a unit test that doesn’t touch the real API.

It is safe because email and password are both checked in a single query.

It is secure as long as HTTPS is used.

It is vulnerable because user-controlled values are used directly in the query, allowing operators like $ne.

It correctly uses bcrypt under the hood.

Nothing

Undefined