Question 1

Explain the concept of 'middleware' in Express.js.

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express interviews — assumes no prior Express-specific knowledge. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The chain-ordering and short-circuiting behavior below was **actually run** against a real Express server — genuine console output, not a description of intended behavior. ## 1. Why This Even Matters — A Story First An airport secu

Question 2

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express and web-security interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header behavior below was **actually observed** from a real running Express server with the real `cors` middleware — genuine response headers, not a description of intended behavior. ## 1. Why This Even Matters — A Story First A nightclub bouncer checks

Question 3

How do you manage sessions and authentication in a Node.js web application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js authentication and system-design interviews — assumes familiarity with the 12-factor app question's real stateless-processes proof. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the session revocation and the JWT tamper-detection below were **actually run** — a real 401 after a real logout, and a real signature-check rejection of a genu

Question 4

What is Helmet and which HTTP security headers should a Node.js API set?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express security interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header diff below is **real, measured** output from two actually-running Express servers — genuine response headers, not a description of what Helmet's documentation says it does. ## 1. Why This Even Matters — A Story First A house with no lock on the door, no pee

Question 5

Explain how the 'crypto' module secures sensitive data in Node.js

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused interviews — assumes basic hashing/encryption vocabulary. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the successful decryption and the tamper-rejection below were **actually run** on Node v24.19.0 — a real thrown authentication error, not a description of what should happen. ## 1. Why This Even Matters — A Story Fir

Question 6

What are some common security best practices in Node.js applications?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `npm audit` and `helmet` results below came from **actually running both** against a real, deliberately-vulnerable setup on Node v24.19.0. ## 1. Why This Even Matters — A St

Question 7

What is the difference between JWT and session-based authentication, and where do refresh tokens fit?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js authentication and API-security interviews — assumes familiarity with this bank's dedicated session-vs-JWT fundamentals question. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The real refresh flow, replay attempt, and family revocation below were **actually run** with Node's built-in `crypto` module — genuine HMAC signing, a genuine expiry fa

Question 8

How do you handle database connection pooling in a Node.js application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js system-design interviews — assumes basic database-client familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The timing comparison below was **actually measured** on Node v24.19.0, using a small, real, hand-built pool — a genuine before/after difference, not an estimate. ## 1. Why This Even Matters — A Story First A courier who driv

Question 9

What is SSRF and how do you mitigate it in a Node.js backend?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security interviews. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the attack and the mitigation below were **actually run** — a real internal service, a real leaked secret, and a real blocked request, not descriptions of intended behavior. ## 1. Why This Even Matters — A Story First A hotel guest cannot walk into the staff-only back of

Question 10

How do you secure your Node.js API endpoints?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js API-security system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `helmet()` header comparison below was **actually run** against two real Express servers on Node v24.19.0. ## 1. Why This Even Matters — A Story First A building's real security

NODE.JSDECODED.

Easy