Question library
Explained questions for the decisions developers make.
Worker thread vs process: when would I use each?
A process is an independently running program with its own address space and operating-system resources. A worker thread is another execution thread inside a process; Node workers have separate JavaScript execution environments and can exchange messages or share selected memory. Workers help CPU parallelism, while processes also provide stronger failure isolation.
What happens during an Express request?
Express handles requests through a sequence of registered middleware and route handlers. Middleware can inspect or change the request, stop it with a response, or pass it onward. The order of registration matters because later handlers see the result of earlier ones.
How should Express handle errors?
Error handling turns application failures into predictable responses and useful internal logs. Express uses error middleware with four arguments to handle errors passed into its request pipeline. Synchronous throws are handled by Express, while promise forwarding differs between Express 4 and 5.
Which HTTP status codes should I know?
An HTTP status code describes the outcome of an HTTP request using a standard numeric category. Clients use it to decide whether to use a result, correct a request, authenticate or retry. A response body can add application details, but should not contradict the status code.
PUT vs PATCH, and what does idempotent mean?
PUT is defined around creating or replacing the state of a target resource, while PATCH applies a described partial change. Idempotency means repeating an identical operation has the same intended server-side effect as doing it once. It does not require every repeated response to contain the same status or body.
HTTP/1.1 vs HTTP/2 vs HTTP/3?
HTTP versions preserve the basic request/response model but change how messages travel over the network. HTTP/2 multiplexes streams over one TCP connection, while HTTP/3 uses QUIC to avoid some transport-level blocking between streams. These improvements affect connection efficiency, not the need for correct API semantics.
How do cookies and sessions work?
A cookie is a small piece of browser-managed data sent automatically with matching requests. A server-side session uses an unpredictable identifier, often in a cookie, to look up login state on the server. This lets the server revoke or change that state without placing all session details in the browser.
What is CORS? Does it protect an API from all clients?
CORS is a browser-enforced protocol that lets a server permit selected cross-origin response access. The browser checks response headers and may send a preflight request before the actual request. It is not a firewall: clients outside the browser can still call the API, and some cross-origin requests can be sent even without readable responses.
How do ETag and caching work?
HTTP caching reuses a stored response when its cache rules allow it, reducing repeated work and data transfer. An ETag identifies a resource representation so the client can ask whether its saved version is still valid. Conditional requests allow the server to say “unchanged” without sending the full representation again.
How should pagination and API versioning work?
Pagination divides a large result set into manageable pages, while API versioning lets an interface change without unexpectedly breaking clients. Both are part of the API contract because callers depend on ordering, limits and field meaning. A good design remains predictable as the data and number of clients grow.
JWT vs refresh token: what is the difference?
JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.
OAuth vs OIDC: what is the difference?
OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.
How do I prevent injection, XSS, CSRF and SSRF?
Injection, XSS, CSRF and SSRF attack different trust boundaries. Injection changes a database command, XSS runs unwanted browser code, CSRF abuses automatically attached credentials, and SSRF makes a server contact an unintended destination. Input validation helps, but each attack also needs controls at the point where the dangerous action happens.
What makes a backend ready for production?
Production readiness means an application can be operated, monitored and recovered under normal load and failure. Working business logic is only one part; configuration, resource limits, startup, shutdown and observability also affect users. A ready service should fail clearly and avoid accepting work it cannot safely complete.
When should I use a queue or Redis?
A queue stores work to be processed separately from the request that created it. Redis is an in-memory data store often used for caching, counters and some queue implementations, with persistence and availability depending on configuration. They solve different problems and should be chosen from the required data-loss and recovery guarantees.
How do I handle backpressure and large uploads?
Backpressure is a feedback mechanism that slows a producer when the consumer cannot keep up. Without it, incoming chunks may accumulate in memory even though the application is using streams. Node streams expose flow-control signals and utilities that help coordinate reading, writing, cleanup and errors.
What should I check for slow APIs, memory growth or intermittent 500s?
Slow responses, growing memory and 500 errors are symptoms, not root causes. A useful investigation connects each symptom to a specific route, instance, input or dependency. Comparing healthy and unhealthy requests often narrows the problem faster than changing settings blindly.
What if the event loop, DB pool or third-party API is stuck?
A stuck backend often means a shared resource is occupied or an operation has no effective deadline. The event loop, connection pool and external API each have different ways to become saturated. Identify which queue is growing before deciding whether to optimize work, cancel it, limit it or scale capacity.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.