Question 1

Explain the concept of 'middleware' in Express.js.

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express interviews — assumes no prior Express-specific knowledge. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The chain-ordering and short-circuiting behavior below was **actually run** against a real Express server — genuine console output, not a description of intended behavior. ## 1. Why This Even Matters — A Story First An airport secu

Question 2

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express and web-security interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header behavior below was **actually observed** from a real running Express server with the real `cors` middleware — genuine response headers, not a description of intended behavior. ## 1. Why This Even Matters — A Story First A nightclub bouncer checks

Question 3

How can you securely store and verify passwords in a Node.js application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused phone screens — assumes very basic hashing familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The hash/verify pair below was **actually run** on Node v24.19.0, using only Node's built-in `crypto` module — no external package installed. ## 1. Why This Even Matters — A Story First A safe-deposit box's combination is ne

Question 4

What is semantic versioning and how do ^, ~, and exact versions behave?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js dependency-management interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Every range check below was **actually run** with the real `semver` package — genuine `true`/`false` results, not a description of the spec. ## 1. Why This Even Matters — A Story First A promise to "only ever make the recipe spicier or add a garnish, never change

Question 5

How do you manage sessions and authentication in a Node.js web application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js authentication and system-design interviews — assumes familiarity with the 12-factor app question's real stateless-processes proof. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the session revocation and the JWT tamper-detection below were **actually run** — a real 401 after a real logout, and a real signature-check rejection of a genu

Question 6

What is Helmet and which HTTP security headers should a Node.js API set?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express security interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header diff below is **real, measured** output from two actually-running Express servers — genuine response headers, not a description of what Helmet's documentation says it does. ## 1. Why This Even Matters — A Story First A house with no lock on the door, no pee

Question 7

Explain how the 'crypto' module secures sensitive data in Node.js

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused interviews — assumes basic hashing/encryption vocabulary. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the successful decryption and the tamper-rejection below were **actually run** on Node v24.19.0 — a real thrown authentication error, not a description of what should happen. ## 1. Why This Even Matters — A Story Fir

Question 8

How do you implement rate limiting in a Node.js Express application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express interviews — assumes basic Express middleware familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The rate-limiter behavior below was **actually run** against a real Express server on Node v24.19.0 — real status codes and real header values, directly answering the prompt's own request to verify it. ## 1. Why This Even Matters

Question 9

What are some common security best practices in Node.js applications?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `npm audit` and `helmet` results below came from **actually running both** against a real, deliberately-vulnerable setup on Node v24.19.0. ## 1. Why This Even Matters — A St

Question 10

What is the difference between JWT and session-based authentication, and where do refresh tokens fit?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js authentication and API-security interviews — assumes familiarity with this bank's dedicated session-vs-JWT fundamentals question. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The real refresh flow, replay attempt, and family revocation below were **actually run** with Node's built-in `crypto` module — genuine HMAC signing, a genuine expiry fa

NODE.JSDECODED.

Easy

Explain the concept of 'middleware' in Express.js.

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

How can you securely store and verify passwords in a Node.js application?

What is semantic versioning and how do ^, ~, and exact versions behave?

Medium

How do you manage sessions and authentication in a Node.js web application?

What is Helmet and which HTTP security headers should a Node.js API set?

Explain how the 'crypto' module secures sensitive data in Node.js

How do you implement rate limiting in a Node.js Express application?

What are some common security best practices in Node.js applications?

What is the difference between JWT and session-based authentication, and where do refresh tokens fit?

How do you handle database connection pooling in a Node.js application?

Explain what 'callback hell' is and how to avoid it.

Hard

What is SSRF and how do you mitigate it in a Node.js backend?

What is the package.json "exports" field and conditional exports?

How do you secure your Node.js API endpoints?