Question 1

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express and web-security interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header behavior below was **actually observed** from a real running Express server with the real `cors` middleware — genuine response headers, not a description of intended behavior. ## 1. Why This Even Matters — A Story First A nightclub bouncer checks

Question 2

What does the Node.js --watch flag do and how does it replace nodemon?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js developer-tooling interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The restart-with-a-new-PID below was **actually observed** from a real running `node --watch` process after a real file edit — not a description of documented behavior. ## 1. Why This Even Matters — A Story First Manually killing a terminal process and re-typing the

Question 3

What are the main security risks of using the 'eval()' function in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused phone screens — no prior security background assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Every consequence below was **actually demonstrated by running real code**, not described as a hypothetical. ## 1. Why This Even Matters — A Story First Handing a stranger a blank check with your signature already on it is fun

Question 4

What is the node:util parseArgs helper for building CLIs?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js CLI-tooling interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the successful parse and the strict-mode rejection below were **actually run** — real, structured output from a real CLI invocation, and a real thrown error, not descriptions of documented behavior. ## 1. Why This Even Matters — A Story First Reaching for a full-featu

Question 5

What does the Node.js `--env-file` flag do, and does it replace dotenv?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js backend interviews — assumes basic `process.env` familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Everything below was **executed against Node v24.19.0** — the raw output is pasted in section 3. ## 1. Why This Even Matters — A Story First For years, every Node tutorial opened the same way: npm install dotenv, then

Question 6

How do you handle environment variables in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — no prior configuration-management experience assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The string-coercion behavior below was **actually verified** on Node v24.19.0, not assumed from how JavaScript "usually" handles types. ## 1. Why This Even Matters — A Story First A form field that only accepts typed text will

Question 7

How do you manage configuration in a Node.js application for different environments?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic `process.env` familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The config-switching behavior below was **actually run** across three different `NODE_ENV` values on Node v24.19.0, including the failure case. ## 1. Why This Even Matters — A Story First A single stage play script works in two different the

Question 8

What are some best practices for structuring a Node.js project?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js system-design interviews — assumes familiarity with the dependency-injection question's real, verified demonstration. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. This is a structural/organizational judgment question; the technical claim it rests on (that layered structure enables real dependency injection) is grounded in the real, verified

Question 9

What is Helmet and which HTTP security headers should a Node.js API set?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express security interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header diff below is **real, measured** output from two actually-running Express servers — genuine response headers, not a description of what Helmet's documentation says it does. ## 1. Why This Even Matters — A Story First A house with no lock on the door, no pee

Question 10

What are the differences between npm, Yarn, and pnpm?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js tooling and package-management interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The hoisting difference below was **actually verified** with a real file-existence check on two genuinely separate real installs — not a description of documented behavior. ## 1. Why This Even Matters — A Story First A messy shared closet where anyone

NODE.JSDECODED.

Easy

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

What does the Node.js --watch flag do and how does it replace nodemon?

What are the main security risks of using the 'eval()' function in Node.js?

What is the node:util parseArgs helper for building CLIs?

What does the Node.js `--env-file` flag do, and does it replace dotenv?

How do you handle environment variables in Node.js?

Medium

How do you manage configuration in a Node.js application for different environments?

What are some best practices for structuring a Node.js project?

What is Helmet and which HTTP security headers should a Node.js API set?

What are the differences between npm, Yarn, and pnpm?

How do you protect a Node.js API against Denial of Service (DoS) and brute-force attacks?

How do you implement rate limiting in a Node.js Express application?

How do you run TypeScript directly in Node.js (native type stripping, tsx, ts-node)?

What are some common security best practices in Node.js applications?