Node.js, Express & HTTP
Trace requests, understand the runtime, and build reliable APIs.
Browse the complete question directory
Node internals
Express lifecycle
HTTP & APIs
Authentication & security
Production engineering
How can Node handle many requests with one JavaScript thread?
Node.js is a JavaScript runtime designed to handle many operations that spend time waiting for I/O. It lets the operating system and supporting runtime facilities wait for work, then runs ready JavaScript callbacks on an event-loop thread. This makes one process useful for many concurrent connections without one JavaScript thread per request.
What do V8, libuv and the thread pool do?
V8 is the engine that executes JavaScript, while libuv provides the event loop and cross-platform I/O support. The libuv thread pool runs certain operations that would otherwise block, such as many file-system calls. These are separate roles: V8 does not itself manage every network request, and not every async call uses a pool thread.
What are the main event-loop phases?
The event loop is the scheduling mechanism that decides when ready callbacks can run. Node organizes several categories of callbacks into phases, with separate processing for promise microtasks and next-tick callbacks. A timer delay is a minimum waiting threshold, not a promise of an exact execution time.
Worker thread vs process: when would I use each?
A process is an independently running program with its own address space and operating-system resources. A worker thread is another execution thread inside a process; Node workers have separate JavaScript execution environments and can exchange messages or share selected memory. Workers help CPU parallelism, while processes also provide stronger failure isolation.
What happens during an Express request?
Express handles requests through a sequence of registered middleware and route handlers. Middleware can inspect or change the request, stop it with a response, or pass it onward. The order of registration matters because later handlers see the result of earlier ones.
How should Express handle errors?
Error handling turns application failures into predictable responses and useful internal logs. Express uses error middleware with four arguments to handle errors passed into its request pipeline. Synchronous throws are handled by Express, while promise forwarding differs between Express 4 and 5.
Which HTTP status codes should I know?
An HTTP status code describes the outcome of an HTTP request using a standard numeric category. Clients use it to decide whether to use a result, correct a request, authenticate or retry. A response body can add application details, but should not contradict the status code.
PUT vs PATCH, and what does idempotent mean?
PUT is defined around creating or replacing the state of a target resource, while PATCH applies a described partial change. Idempotency means repeating an identical operation has the same intended server-side effect as doing it once. It does not require every repeated response to contain the same status or body.
HTTP/1.1 vs HTTP/2 vs HTTP/3?
HTTP versions preserve the basic request/response model but change how messages travel over the network. HTTP/2 multiplexes streams over one TCP connection, while HTTP/3 uses QUIC to avoid some transport-level blocking between streams. These improvements affect connection efficiency, not the need for correct API semantics.
How do cookies and sessions work?
A cookie is a small piece of browser-managed data sent automatically with matching requests. A server-side session uses an unpredictable identifier, often in a cookie, to look up login state on the server. This lets the server revoke or change that state without placing all session details in the browser.
What is CORS? Does it protect an API from all clients?
CORS is a browser-enforced protocol that lets a server permit selected cross-origin response access. The browser checks response headers and may send a preflight request before the actual request. It is not a firewall: clients outside the browser can still call the API, and some cross-origin requests can be sent even without readable responses.
How do ETag and caching work?
HTTP caching reuses a stored response when its cache rules allow it, reducing repeated work and data transfer. An ETag identifies a resource representation so the client can ask whether its saved version is still valid. Conditional requests allow the server to say “unchanged” without sending the full representation again.
How should pagination and API versioning work?
Pagination divides a large result set into manageable pages, while API versioning lets an interface change without unexpectedly breaking clients. Both are part of the API contract because callers depend on ordering, limits and field meaning. A good design remains predictable as the data and number of clients grow.
JWT vs refresh token: what is the difference?
JWT is a token format, not a role: an access token can be a JWT or another format. An access token authorizes calls to an API, while a refresh token is used with the identity service to obtain new access tokens. Separating these roles limits how long a stolen access token is useful and supports longer login sessions.
OAuth vs OIDC: what is the difference?
OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.
How do I prevent injection, XSS, CSRF and SSRF?
Injection, XSS, CSRF and SSRF attack different trust boundaries. Injection changes a database command, XSS runs unwanted browser code, CSRF abuses automatically attached credentials, and SSRF makes a server contact an unintended destination. Input validation helps, but each attack also needs controls at the point where the dangerous action happens.
What makes a backend ready for production?
Production readiness means an application can be operated, monitored and recovered under normal load and failure. Working business logic is only one part; configuration, resource limits, startup, shutdown and observability also affect users. A ready service should fail clearly and avoid accepting work it cannot safely complete.
When should I use a queue or Redis?
A queue stores work to be processed separately from the request that created it. Redis is an in-memory data store often used for caching, counters and some queue implementations, with persistence and availability depending on configuration. They solve different problems and should be chosen from the required data-loss and recovery guarantees.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.