Question 1

What is Draft Mode in Next.js and how does it work with a headless CMS?

Accepted Answer

**Target Audience:** Frontend engineers preparing for Next.js interviews — assumes basic React and App Router familiarity.
**Difficulty:** Medium

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:`. Every behaviour claim was checked against the Next.js 16.4.2 docs shipped with the package and, in the **Verified** section, against real output from a build, a running server or a real Chromium browser. **No real CMS was used:** the lab

Question 2

How do you read cookies and headers in Next.js (cookies(), headers())?

Accepted Answer

**Target Audience:** Developers preparing for Next.js interviews — assumes basic App Router knowledge (Server Components, Server Actions).
**Difficulty:** Medium

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:`. Every behaviour claim was checked against the Next.js 16.4.2 docs shipped with the package and, in the **Verified** section, against lab builds, `curl` requests to `next start` and a Chromium browser.

## 1. Why This Even

Question 3

What is Middleware in Next.js and what can it do?

Accepted Answer

**Target Audience:** Frontend engineers preparing for Next.js interviews — assumes basic React and App Router familiarity.
**Difficulty:** Medium

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:`. Every behaviour claim was checked against the Next.js docs shipped with the package (written on 16.3.4, re-reviewed against 16.4.2) and, in the **Verified** section, against real output from a build or a running server; each Verified bloc

Question 4

What is JSON-LD structured data and how do you add it in Next.js?

Accepted Answer

**Target Audience:** Frontend engineers preparing for Next.js interviews — assumes basic React and App Router familiarity.
**Difficulty:** Medium

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:`. Every behaviour claim was checked against the Next.js docs shipped with the package (written on 16.3.4, re-reviewed against 16.4.2) and, in the **Verified** section, against real output from a build or a running server; each Verified bloc

Question 5

How do you keep secrets and server code out of the client bundle in Next.js (server-only, taint, Data Access Layer)?

Accepted Answer

**Target Audience:** Frontend engineers preparing for Next.js interviews — assumes basic React and App Router familiarity.
**Difficulty:** Medium

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:`. Every behaviour claim was checked against the Next.js 16.4.2 docs shipped with the package and, in the **Verified** section, against real output from a build, a running server or a real Chromium browser. The secrets in the lab are fake st

Question 6

What are the security considerations for Server Actions in Next.js?

Accepted Answer

**Target Audience:** Frontend engineers preparing for Next.js interviews — assumes basic React and App Router familiarity.
**Difficulty:** Hard

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:`. Every behaviour claim was checked against the Next.js docs shipped with the package (written on 16.3.4, re-reviewed against 16.4.2) and, in the **Verified** section, against real output from a build or a running server; each Verified block

Question 7

How do you set security headers and a nonce-based Content Security Policy in Next.js?

Accepted Answer

**Target Audience:** Full-stack engineers preparing for senior Next.js interviews — assumes App Router basics and a little HTTP.
**Difficulty:** Hard

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:`. Every behaviour claim was checked against the Next.js 16.4.2 docs shipped with the package (the Content Security Policy guide and the proxy reference) and, in the **Verified** section, against real `curl` output and a real Chromium br

NEXT.JSDECODED.

Medium

What is Draft Mode in Next.js and how does it work with a headless CMS?

How do you read cookies and headers in Next.js (cookies(), headers())?

What is Middleware in Next.js and what can it do?

What is JSON-LD structured data and how do you add it in Next.js?

How do you keep secrets and server code out of the client bundle in Next.js (server-only, taint, Data Access Layer)?

Hard

What are the security considerations for Server Actions in Next.js?

How do you set security headers and a nonce-based Content Security Policy in Next.js?